PT-2026-24711 · Gitlab · Gitlab Ce/Ee

Go7F0 · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-0602

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.6 through 18.7.6 GitLab CE/EE versions 18.8 through 18.8.6 GitLab CE/EE versions 18.9 through 18.9.2

Description An authenticated user could potentially disclose metadata from private issues, merge requests, epics, milestones, or commits. This is due to improper filtering during the snippet rendering process under specific conditions. The issue affects GitLab CE/EE.

Recommendations Update GitLab CE/EE to version 18.7.6 or later. Update GitLab CE/EE to version 18.8.6 or later. Update GitLab CE/EE to version 18.9.2 or later.

Exploit

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

BDU:2026-03435

BIT-GITLAB-2026-0602

CVE-2026-0602

Produtos afetados

Gitlab Ce/Ee

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0602.json · Exploit
• 🔥 https://hackerone.com/reports/3486504 · Exploit
• https://ubuntu.com/security/CVE-2026-0602 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-0602 · Nota de Segurança
• https://gitlab.com/gitlab-org/gitlab/-/work_items/585007 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0602 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-0602 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032998316934390217 · Publicação no Twitter
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0602 · Nota
• https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-gitlab-2026-0602 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-0602 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-03435 · Nota de Segurança