CVE-2019-15590

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155916.5An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning report CVE-2019-155924.3GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associat CVE-2019-155936.5GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service att CVE-2019-155944.3GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request e CVE-2019-155958.8A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands CVE-2019-155967.5A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within t CVE-2019-155979.8A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.CVE-2019-155989.8A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the c CVE-2019-155999.8A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the CVE-2019-156007.5A Path traversal exists in http_server which allows an attacker to read arbitrary system files.CVE-2019-156026.1The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in CVE-2019-156036.1The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory