PT-2026-24711 · Gitlab · Gitlab Ce/Ee

Go7F0 · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-0602

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.6 through 18.7.6 GitLab CE/EE versions 18.8 through 18.8.6 GitLab CE/EE versions 18.9 through 18.9.2

Description An authenticated user could potentially disclose metadata from private issues, merge requests, epics, milestones, or commits. This is due to improper filtering during the snippet rendering process under specific conditions. The issue affects GitLab CE/EE.

Recommendations Update GitLab CE/EE to version 18.7.6 or later. Update GitLab CE/EE to version 18.8.6 or later. Update GitLab CE/EE to version 18.9.2 or later.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2026-03435

BIT-GITLAB-2026-0602

CVE-2026-0602

Affected Products

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0602.json · Exploit
• 🔥 https://hackerone.com/reports/3486504 · Exploit
• https://ubuntu.com/security/CVE-2026-0602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0602 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0602 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-0602 · Vendor Advisory
• https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2026-0602 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-0602 · Security Note
• https://bdu.fstec.ru/vul/2026-03435 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/585007 · Note
• https://twitter.com/CVEnew/status/2032998316934390217 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0602 · Note