low · CVSS v3 3.5

CVE-2026-117649

This CVE exposes metadata of private issues linked as dependencies to public issues, allowing anonymous or unauthenticated users to view tit

Overview

This CVE exposes metadata of private issues linked as dependencies to public issues, allowing anonymous or unauthenticated users to view titles, bodies, labels, and attachment names via the API and web page. The flaw occurs when a readable issue references a private issue, bypassing access controls on the linked issue's content. It matters because it leaks sensitive information about private repositories to anyone who can view the public issue.

Description

The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.

Impact

Confidentiality: Private issue metadata exposed. Integrity: No direct impact. Availability: No impact. Defenders of GitLab installations, especially those with public issues referencing private issues, should be aware of this exposure.

Remediation

Upgrade to GitLab 28.2.0 or later, which filters dependency events with proper read permission checks. Verify that issue linking between public and private repositories is appropriately restricted. Review API responses for unexpected metadata and adjust permissions if necessary.

Risk context

Low severity, CVSS 3.5, no EPSS data. The issue is not critical but may expose sensitive metadata. Defenders should address promptly.

Affected products

  • GitLab

Scores

Severity
low
CVSS v2
3.5
CVSS v3
3.5
CVSS v4
—
EPSS
—

issue-linking metadata-exposure GitLab public-private access-control low-severity

← All CVEs

Related CVEs

low

CVE-2026-120310

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.

View analysis

low

CVE-2026-117680

Improper check for unusual or exceptional conditions in the pattern and patternProperties keywords of the lud jsv library allows an unauthenticated remote attacker to bypass schema validation by exploiting backtracking budget exhaustion. This can lead to acceptance of malicious data that would otherwise be rejected. The vulnerability affects jsv versions 0.1.0 through 0.26.2.

View analysis

low

CVE-2026-120223

A low‑severity flaw in Oray Pugongying X5 Pro (v≤7.6.1) allows remote attackers to manipulate the _user argument in session_get, producing insufficiently random session IDs. This can lead to session prediction or hijacking. The vulnerability is publicly documented but the vendor has not released a fix.

View analysis

low

CVE-2026-54610

LibreDWG's bit_TV_to_utf8() can write to caller-provided buffer, causing segmentation faults or unintended data modification. The flaw exists in versions before 0.14 and may lead to denial of service or data integrity issues when processing untrusted DWG files.

View analysis