VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Sep 15, 2026· Updated Sep 28, 2026

CVE-2026-82837

CVE-2026-82837

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints.

Affected products

5
  • GitLab Inc./GitLab3 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 2 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=10.1.0,<19.1.8
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=10.1.0,<19.1.8
    • (no CPE)range: from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
  • GitLab Inc./GitLab EE and CEllm-fuzzy
    Range: from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 10.1.0, < 19.1.8

Patches

Vulnerability mechanics

References

1

News mentions

1