CVE Explorer

CVE-2026-15077

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:cae730447c8ba5151e0acb6c8ca2f2b0c2501a826dec255eca1d5dcd5f7ffeda

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"19.1.3","status":"affected","version":"19.1","versionType":"semver"},{"lessThan":"19.2.1","status":"affected","version":"19.2","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:599354430da661631641932c206346164e96bdbace4b0def58e426f654de9327 · sha256:55d6a3b5483688ad… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:599354430da661631641932c206346164e96bdbace4b0def58e426f654de9327 · sha256:55d6a3b5483688ad… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-1427","description":"CWE-1427: Improper Neutralization of Input Used for LLM Prompting","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:599354430da661631641932c206346164e96bdbace4b0def58e426f654de9327 · sha256:55d6a3b5483688ad… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:599354430da661631641932c206346164e96bdbace4b0def58e426f654de9327 · sha256:55d6a3b5483688ad… · /containers/cna/references/1

{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/601482"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:599354430da661631641932c206346164e96bdbace4b0def58e426f654de9327 · sha256:55d6a3b5483688ad… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer