CVE-2026-1182

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized access to confidential issue title created in public projects under certain circumstances.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-212

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 8.14, < 18.7.6; >= 18.8, < 18.8.6; >= 18.9, < 18.9.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/586613Broken Link
https://hackerone.com/reports/3515716Permissions Required

Timeline

Published: Mar 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-118206.5A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API CVE-2026-1182005.5Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could le CVE-2026-1182017.5The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentica CVE-2026-1182027.5The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before c CVE-2026-1182046.4The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Script CVE-2026-1182057.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all CVE-2026-1182078.8Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.CVE-2026-1182087.1Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.CVE-2026-118215.4The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass CVE-2026-1182135.9Relative path traversal in Windows Deployment Services allows an unauthorized attacker to disclose information over a network.CVE-2026-1182146.5Use of uninitialized resource in Windows Advanced Rasterization Platform allows an authorized attacker to disclose information locally.CVE-2026-1182157.8Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.