CVE-2026-0602

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 15.6, < 18.7.6; >= 18.8, < 18.8.6; >= 18.9, < 18.9.2

References

https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/585007Broken Link
https://hackerone.com/reports/3486504Permissions Required

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-06038.3A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing s CVE-2026-06046.5The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and inclu CVE-2026-06059.8A security vulnerability has been detected in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionalit CVE-2026-06069.8A vulnerability was detected in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Front CVE-2026-06079.8A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminViewSongs.php CVE-2026-06086.4The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all version CVE-2026-06096.4The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-06109.8SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 CVE-2026-06119.8Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerabi CVE-2026-06127.5The Librarian contains a information leakage vulnerability through the `web_fetch` tool, which can be used to retrieve arbitrary external co CVE-2026-06137.5The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behav CVE-2026-06157.3The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within The