GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.
References
| Link | Resource |
|---|---|
| https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ | Release Notes Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/work_items/627167 | Issue Tracking |
| https://hackerone.com/reports/3551698 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
22 Oct 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks. |
14 Oct 2026, 14:07
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitlab
Gitlab gitlab |
|
| References | () https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ - Release Notes, Vendor Advisory | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/work_items/627167 - Issue Tracking | |
| References | () https://hackerone.com/reports/3551698 - Permissions Required | |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
13 Oct 2026, 02:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-13 02:17
Updated : 2026-10-22 12:16
NVD link : CVE-2026-84284
Mitre link : CVE-2026-84284
CVE.ORG link : CVE-2026-84284
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-863
Incorrect Authorization