CVE-2026-0602

MEDIUM

GitLab 15.6-18.7.5, 18.8-18.8.5, 18.9-18.9.1 - Authenticated Metadata Disclosure via Snippet Rendering

Title source: llm
STIX 2.1

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.

References (3)

Core 3
Core References
Third Party Advisory technical-description exploit permissions-required
https://hackerone.com/reports/3486504

Scores

CVSS v3 4.3
EPSS 0.0024
EPSS Percentile 15.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-288
Status published
Products (1)
gitlab/gitlab 15.6.0 - 18.7.6 (2 CPE variants)
Published Mar 11, 2026
Tracked Since Mar 11, 2026