Threats tagged 'bit-gitlab-2026-13319'

A vulnerability in GitLab CE/EE versions from 15.10 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 allows an authenticated user to bypass authorization checks and read milestone metadata from arbitrary private projects without membership. The flaw is due to missing authorization on a user-controlled project filter parameter in the group milestones API. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.