PT-2026-31542 · Gitlab · Gitlab Ce/Ee

Ahacker1 · Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-2104

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.8.9, 18.9 through 18.9.5, and 18.10 through 18.10.3

Description A flaw exists in GitLab CE/EE that could allow an authenticated user to access confidential issues assigned to other users through CSV export. This is due to insufficient authorization checks during the export process.

Recommendations Update to GitLab CE/EE version 18.8.9 or later. Update to GitLab CE/EE version 18.9.5 or later. Update to GitLab CE/EE version 18.10.3 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-05149

BIT-GITLAB-2026-2104

CVE-2026-2104

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://hackerone.com/reports/3541476 · Exploit
• https://ubuntu.com/security/CVE-2026-2104 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2104 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2104 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-2104 · Vendor Advisory
• https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05149 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2104 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2042012702751514934 · Twitter Post
• https://twitter.com/CVEnew/status/2042010549022597431 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/589021 · Note