CVE-2026-13319: GitLab CE/EE authorization bypass through user-controlled key in group milestones API

The group milestones API accepts a project filter parameter. GitLab says it lacked an authorization check (CWE-639, authorization bypass through a user-controlled key), so supplying the identifier of a private project made the API return that project's milestone data even though the caller was not a member. The leaked fields are milestone titles, descriptions and the full project path.

The flaw reaches across the instance: the bulletin says arbitrary private projects were exposed. The attacker needs only an ordinary account, which on instances that allow open sign-up is easy to get. Project paths also reveal which private projects exist and how they are named, and milestone text often contains release plans, customer names or security work.

The CVSS 3.1 score is 4.3 (medium): network access, low privileges, no user interaction and a low confidentiality effect, with no integrity or availability effect. Only reading is affected. The range goes back to 15.10, so long-lived instances have carried the flaw for years. The reporter is credited as a0xnirudh, and no exploitation is reported.

GitLab CE and EE, all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Instances with private projects and many users, or with open registration, are the most exposed. Check the version in the Admin Area, on the /help page, or on the host:

dpkg -l gitlab-ee gitlab-ce

Upgrade to GitLab 19.5.1, 19.4.3 or 19.3.6, released October 21, 2026. The bulletin names no workaround and urges self-managed administrators to upgrade as soon as possible; GitLab.com is already patched.

The bulletin gives no log signature. Check API and access logs for requests to group milestone endpoints that include a project filter parameter, especially from accounts that are not members of the projects named in the filter, or that request many different project identifiers in a short time.

An authenticated user could have read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API. Impacted versions: GitLab CE/EE all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Fixed in GitLab CE/EE 19.5.1, 19.4.3 and 19.3.6, released October 21, 2026.