CVE-2026-14351

MediumCVSS 4.3/10Last modified Aug 3, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-1230

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 8.8, < 19.0.5; >= 19.1, < 19.1.3; >= 19.2, < 19.2.1

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/604691Broken Link
https://hackerone.com/reports/3708242Permissions Required

Timeline

Published: Jul 29, 2026
Last modified: Aug 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-143527.5The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' p CVE-2026-143548.7CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modific CVE-2026-143555.3In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation CVE-2026-143568.8The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to th CVE-2026-143578.8The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing CVE-2026-143586.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - C CVE-2026-143598.8The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. T CVE-2026-14366.5Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user CVE-2026-143614.7The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allo CVE-2026-143624.9HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attac CVE-2026-143639.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - C CVE-2026-143649.8The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset