CVE-2026-4524

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-452427.1Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to CVE-2026-452436.1Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicioCVE-2026-452445.4Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions withoutCVE-2026-452457.4Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover CVE-2026-452465.5Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows locaCVE-2026-452479.8Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticatCVE-2026-452485.3Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows CVE-2026-452496.1A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects ApacCVE-2026-45258.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to VaCVE-2026-452507.8The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-suCVE-2026-452517.8A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked tCVE-2026-452525.5When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve t