CVE-2020-26415

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-862

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.2 to <13.4.7; >=13.5 to <13.5.5; >=13.6 to <13.6.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26415.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/277337Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26415.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/277337Broken Link

Timeline

Published: Dec 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-264164.4Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This CVE-2020-264175.3Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 CVE-2020-264185.3Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted captu CVE-2020-264195.3Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file.CVE-2020-26426.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versi CVE-2020-264205.3Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted captur CVE-2020-264215.3Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet CVE-2020-264225.3Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file CVE-2020-26436.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Job System). Supported versions that CVE-2020-26446.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). Supported CVE-2020-26456.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versi CVE-2020-26465.4Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Command Line Interface). Supported ve