PT-2026-31542

CVE-2026-2104

Published

2026-04-08

Updated

2026-04-13

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.8.9, 18.9 through 18.9.5, and 18.10 through 18.10.3

Description A flaw exists in GitLab CE/EE that could allow an authenticated user to access confidential issues assigned to other users through CSV export. This is due to insufficient authorization checks during the export process.

Recommendations Update to GitLab CE/EE version 18.8.9 or later. Update to GitLab CE/EE version 18.9.5 or later. Update to GitLab CE/EE version 18.10.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ahacker1

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers

CVE-2026-2104