{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"GCVE-110-NCSC-2026-447","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-22T09:12:12Z","dateUpdated":"","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"nl","value":"GitLab versions prior to 19.3.6, 19.4.3, and 19.5.1 contained a vulnerability allowing authenticated users with read_api-scoped tokens to bypass token restrictions and access project incoming email addresses via a GraphQL field with insufficient scope enforcement.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a security vulnerability in certain GitLab CE/EE versions where authenticated users could access milestone metadata from private projects without proper authorization due to missing checks in the group milestones API.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a security flaw in GitLab EE versions 17.4 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to bypass merge request approval policies on protected branches due to improper access control during approval rule synchronization.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a security flaw in multiple versions where an authenticated user could hijack LDAP-backed accounts via improper input sanitization in LDAP email lookup during OmniAuth SAML and LDAP auto-linking.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a security flaw in GitLab EE versions prior to 19.3.6, 19.4.3, and 19.5.1 that allowed users to bypass instance-wide SAML or LDAP membership locks, enabling unauthorized project and group memberships outside identity provider controls.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a security vulnerability in GitLab EE versions where group Owners could circumvent admin locks to reactivate AI-driven data egress to third-party services against administrator restrictions.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a security flaw in versions 15.0 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where authenticated users without project membership could view confidential issue titles from private projects via public merge requests due to improper caching.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a vulnerability in versions 17.6.5 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where unauthenticated users could access sensitive internal server credentials due to improper filtering of internal response headers.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in GitLab CE/EE versions 7.0 through certain 19.x releases allows unauthenticated users to execute arbitrary code via an integer overflow triggered by a crafted regular expression.","supportingMedia":null},{"lang":"nl","value":"GitLab versions 18.3 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 contained a vulnerability allowing unauthenticated users to manipulate OAuth/OIDC discovery documents via a shared cache, enabling redirection to external servers due to improper validation of cached endpoint URLs.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users with read-only access to permanently delete existing vulnerability records due to improper error handling.","supportingMedia":null},{"lang":"nl","value":"GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to access paid AI features without valid subscription due to insufficient server-side billing validation.","supportingMedia":null}],"references":[{"url":"https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0447.json","name":"","tags":["advisory"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12664.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13319.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14288.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15723.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16255.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103515.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105711.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105777.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110264.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112212.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112326.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112378.json","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Incorrect Authorization","cweId":"CWE-863","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Authorization Bypass Through User-Controlled Key","cweId":"CWE-639","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Use of Incorrectly-Resolved Name or Reference","cweId":"CWE-706","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","cweId":"CWE-90","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Use of Cache Containing Sensitive Information","cweId":"CWE-524","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Insertion of Sensitive Information Into Sent Data","cweId":"CWE-201","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Integer Overflow or Wraparound","cweId":"CWE-190","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","cweId":"CWE-444","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Cleanup on Thrown Exception","cweId":"CWE-460","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Use of Less Trusted Source","cweId":"CWE-348","type":"CWE"}]}],"affected":[{"vendor":"GitLab","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["CVE-2026-103515","CVE-2026-105711","CVE-2026-105777","CVE-2026-110264","CVE-2026-112212","CVE-2026-112326","CVE-2026-112378","CVE-2026-12664","CVE-2026-13319","CVE-2026-14288","CVE-2026-15723","CVE-2026-16255"]}},"adp":null}}