CVE-2026-13319: 
GitLab vulnerability analysis and mitigation

CVE-2026-13319 is an authorization bypass vulnerability in GitLab CE/EE that allows authenticated users to read milestone metadata — including titles, descriptions, and full project paths — from arbitrary private projects across a GitLab instance without any project membership. The flaw affects all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It was published on October 22, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, EUVD).

The root cause is a missing authorization check on a user-supplied project filter parameter in the group milestones API endpoint, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). An authenticated attacker can supply an arbitrary project ID or path as a filter value in API requests to the group milestones endpoint, and the server returns milestone data for that project without verifying whether the requester has any membership or access rights to it. The attack vector is network-based, requires low privileges (any authenticated account), no user interaction, and low attack complexity (Feedly, EUVD).

Successful exploitation allows an authenticated attacker to enumerate milestone metadata — including milestone titles, descriptions, and full project paths — from any private project on the GitLab instance, regardless of their membership status. This constitutes an unauthorized information disclosure that could expose sensitive project planning details, internal project naming conventions, and organizational structure. There is no integrity or availability impact; the vulnerability is limited to confidentiality (Feedly, EUVD).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the publication date. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The low barrier to exploitation — requiring only a valid authenticated session — means the risk could increase if details become more widely known (Feedly, EUVD).

1. Obtain authentication: Acquire any valid GitLab account on the target instance (e.g., a low-privilege user or a self-registered account if open registration is enabled).
2. Identify target projects: Enumerate or guess private project IDs or paths on the instance using publicly visible information, search features, or incremental ID enumeration.
3. Craft malicious API request: Send an authenticated GET request to the group milestones API endpoint, supplying the target private project's ID or path as the project filter parameter — for example: GET /api/v4/groups/<group_id>/milestones?project_ids[]=<target_private_project_id>.
4. Retrieve milestone metadata: The server returns milestone data (titles, descriptions, full project paths) for the specified private project without enforcing access control checks on the filter parameter.
5. Enumerate at scale: Repeat the request with different project IDs to systematically harvest milestone metadata across multiple private projects on the instance (Feedly, EUVD).

• Network/Logs: Unusual or high-volume authenticated API requests to /api/v4/groups/<group_id>/milestones with varying project_ids[] parameters, especially from accounts with no membership in the referenced projects.
• Logs: GitLab API access logs showing a single user account querying milestone data for a large number of distinct project IDs in a short time window.
• Logs: Requests returning milestone data for projects where the requesting user has no recorded membership, which may appear anomalous in audit log reviews.

GitLab has released patched versions addressing this vulnerability: 19.3.6, 19.4.3, and 19.5.1. All GitLab CE/EE administrators running versions from 15.10 onward should upgrade to one of these fixed releases immediately. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation (GitLab Patch Release, EUVD).

The vulnerability was covered by security news outlets including SecurityOnline and CyberSecurityNews, with the latter noting it as part of a broader GitLab patch release addressing multiple issues. The HackerOne report (H1-3792168) indicates it was responsibly disclosed through GitLab's bug bounty program. Community discussion was observed on Infosec.Exchange, though overall reaction volume was modest given the medium severity rating (SecurityOnline, CyberSecurityNews).