CVE-2026-15077

MediumCVSS 4.3/10Last modified Aug 3, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2026
Last modified
Aug 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-150788.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper vCVE-2026-150795.4Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects LoginCVE-2026-15084.3The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers toCVE-2026-150804.3Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects RCVE-2026-150817.4Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL InCVE-2026-150825.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows CrCVE-2026-150834.2Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allowCVE-2026-150845.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) CVE-2026-150855.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows StorCVE-2026-150865.9vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.CVE-2026-150875.9vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.CVE-2026-150885.7Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
CVE-2026-15077: Medium severity, CVSS 4.3 | Vulnix