GCVE-110-NCSC-2026-270

Advisory PublishedCVSS 4.3/10

Vulnetix · Advisory published July 30, 2026

GitLab addressed an access control vulnerability in versions prior to 19.0.5, 19.1.3, and 19.2.1 that allowed authenticated guest-role users to access unauthorized test report data.

Download JSON Open in Console

Weaknesses (CWE)

CWE-862Missing AuthorizationCWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesCWE-522Insufficiently Protected CredentialsCWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-201Insertion of Sensitive Information Into Sent DataCWE-770Allocation of Resources Without Limits or ThrottlingCWE-863Incorrect AuthorizationCWE-1230Exposure of Sensitive Information Through MetadataCWE-1427Improper Neutralization of Input Used for LLM PromptingCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-1270Generation of Incorrect Security Tokens

Risk Scores

CVSS 3.1

4.3/10

Medium · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions	Platforms
GitLab	vers:unknown/*	—	—

Aliases

CVE-2025-14562 CVE-2026-12436 CVE-2026-13113 CVE-2026-14341 CVE-2026-14351 CVE-2026-15077 CVE-2026-15831 CVE-2026-15975 CVE-2026-16553 CVE-2026-3093 CVE-2026-4672 CVE-2026-6267 CVE-2026-6336

References

advisory

Browse GCVE Records

75,823 records in the GCVE database · Updated August 3, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON