{"api_version":"1","generated_at":"2026-07-23T10:32:11+00:00","cve":"CVE-2019-15727","urls":{"html":"https://cve.report/CVE-2019-15727","api":"https://cve.report/api/cve/CVE-2019-15727.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-15727","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-15727"},"summary":{"title":"CVE-2019-15727","description":"An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-09-16 17:15:00","updated_at":"2019-09-18 14:03:00"},"problem_types":["CWE-200"],"metrics":[],"references":[{"url":"https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/","name":"https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/","refsource":"CONFIRM","tags":["Release Notes","Vendor Advisory"],"title":"GitLab Security Release: 12.2.3, 12.1.8, and 12.0.8\n|\nGitLab","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://gitlab.com/gitlab-org/gitlab-ee/issues/11426","name":"https://gitlab.com/gitlab-org/gitlab-ee/issues/11426","refsource":"MISC","tags":["Broken Link"],"title":"CI metrics for MRs  are accessible for users without CI access (#11426) · Issues · GitLab.org / GitLab · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15727","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15727","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"15727","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"15727","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"15727","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"community","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"15727","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gitlab","cpe5":"gitlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-15727","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://gitlab.com/gitlab-org/gitlab-ee/issues/11426","refsource":"MISC","name":"https://gitlab.com/gitlab-org/gitlab-ee/issues/11426"},{"refsource":"CONFIRM","name":"https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/","url":"https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/"}]}},"nvd":{"publishedDate":"2019-09-16 17:15:00","lastModifiedDate":"2019-09-18 14:03:00","problem_types":["CWE-200"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"12.2.0","versionEndExcluding":"12.2.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"12.2.0","versionEndExcluding":"12.2.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"12.1.0","versionEndExcluding":"12.1.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"12.1.0","versionEndExcluding":"12.1.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"11.2.0","versionEndExcluding":"12.0.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"11.2.0","versionEndExcluding":"12.0.8","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"15727","Ordinal":"155286","Title":"CVE-2019-15727","CVE":"CVE-2019-15727","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"15727","Ordinal":"1","NoteData":"An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"15727","Ordinal":"2","NoteData":"2019-09-16","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"15727","Ordinal":"3","NoteData":"2019-09-16","Type":"Other","Title":"Modified"}]}}}