CVE-2026-13319: 
GitLab 脆弱性分析と緩和策

CVE-2026-13319 is an authorization bypass vulnerability in GitLab CE/EE that allows authenticated users to read milestone metadata — including titles, descriptions, and full project paths — from arbitrary private projects across a GitLab instance without any project membership. The flaw stems from missing authorization checks on a user-supplied project filter parameter in the group milestones API. It affects all versions from 15.10 before 19.3.6, 19.4.0 before 19.4.3, and 19.5.0 before 19.5.1. Disclosed on October 22, 2026, it carries a CVSS v3.1 base score of 6.5 (Medium) per NVD (GitLab Patch Release, EUVD).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the group milestones API endpoint accepts a user-supplied project filter parameter without validating whether the requesting user has access to the specified project. By manipulating this parameter, an authenticated attacker can query milestone data from private projects they are not a member of. The attack vector is network-based, requires low privileges (any authenticated account), no user interaction, and low attack complexity. The vulnerability was originally reported via HackerOne (report #3792168) and tracked internally at GitLab work item #604064 (EUVD).

Successful exploitation allows an authenticated attacker to enumerate sensitive project metadata — milestone titles, descriptions, and full project paths — from any private project on the GitLab instance, regardless of membership. This constitutes a high confidentiality impact with no integrity or availability impact. While the vulnerability does not enable code execution or data modification, it can facilitate reconnaissance by revealing internal project structure, naming conventions, and roadmap details that could be leveraged in further targeted attacks (GitLab Patch Release, EUVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (EUVD). The NVD SSVC assessment confirms exploitation status as "none" and technical impact as "partial." The EPSS score is approximately 0.0022 (0.22%), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Nessus plugin 370169 and Qualys detection ID 389121.

1. Authentication: Obtain any valid GitLab account on the target instance — even a low-privilege user account with no project memberships is sufficient.
2. Identify target group: Enumerate accessible groups on the instance using the GitLab Groups API (GET /api/v4/groups) to identify group IDs.
3. Craft malicious API request: Send a request to the group milestones API endpoint, supplying a user-controlled project_ids[] or equivalent project filter parameter referencing a private project the attacker does not have access to. Example: GET /api/v4/groups/<group_id>/milestones?project_ids[]=<target_private_project_id>.
4. Retrieve milestone metadata: Due to the missing authorization check, the API returns milestone titles, descriptions, and full project paths for the specified private project without validating membership.
5. Enumerate at scale: Iterate over a range of project IDs to systematically harvest metadata from multiple private projects across the instance (EUVD).

• Network: Unusual or high-volume API requests to /api/v4/groups/<id>/milestones with project_ids[] parameters referencing projects the requesting user is not a member of.
• Logs: GitLab API access logs showing repeated milestone API calls from a single authenticated user across many different group or project IDs in a short time window; requests returning data for projects with no membership relationship to the requester.
• Behavior: A single low-privilege account making systematic, sequential requests with incrementing project ID values, indicative of automated enumeration.

GitLab has released patched versions addressing this vulnerability: 19.3.6, 19.4.3, and 19.5.1. All GitLab CE/EE deployments running versions from 15.10 through the affected ranges should upgrade immediately. As a temporary workaround while patches are deployed, administrators can restrict API access to trusted users or networks where feasible. GitLab.com (SaaS) has already been patched (GitLab Patch Release).

The vulnerability received coverage from several security news outlets including Heise, CyberSecurityNews, and GBHackers, primarily in the context of a broader GitLab patch release that also addressed a critical RCE vulnerability, which drew more attention than CVE-2026-13319 itself (Heise, CyberSecurityNews). Community reaction was moderate, with the information disclosure nature of the bug considered less severe compared to the critical RCE patched in the same release cycle.