CVE-2019-7176

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-71777.2Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.CVE-2019-71787.2Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup.CVE-2019-71817.5Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program.CVE-2019-71839.8This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updati CVE-2019-71844.8This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s CVE-2019-71854.8This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s CVE-2019-71929.8This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, CVE-2019-71939.8This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP CVE-2019-71949.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,CVE-2019-71959.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,CVE-2019-71974.8A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may CVE-2019-71989.8This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed th