{"api_version":"1","generated_at":"2026-05-14T11:44:57+00:00","cve":"CVE-2026-8144","urls":{"html":"https://cve.report/CVE-2026-8144","api":"https://cve.report/api/cve/CVE-2026-8144.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-8144","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-8144"},"summary":{"title":"Missing Authorization in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.","state":"PUBLISHED","assigner":"GitLab","published_at":"2026-05-14 06:16:25","updated_at":"2026-05-14 06:16:25"},"problem_types":["CWE-862","CWE-862 CWE-862: Missing Authorization"],"metrics":[{"version":"3.1","source":"cve@gitlab.com","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/591964","name":"https://gitlab.com/gitlab-org/gitlab/-/work_items/591964","refsource":"cve@gitlab.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/","name":"https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/","refsource":"cve@gitlab.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8144","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8144","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"GitLab","product":"GitLab","version":"affected 15.1 18.9.7 semver","platforms":[]},{"source":"CNA","vendor":"GitLab","product":"GitLab","version":"affected 18.10 18.10.6 semver","platforms":[]},{"source":"CNA","vendor":"GitLab","product":"GitLab","version":"affected 18.11 18.11.3 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to versions 18.9.7, 18.10.6, 18.11.3 or above.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"This vulnerability has been discovered internally by GitLab team member Terri Chu","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"18.9.7","status":"affected","version":"15.1","versionType":"semver"},{"lessThan":"18.10.6","status":"affected","version":"18.10","versionType":"semver"},{"lessThan":"18.11.3","status":"affected","version":"18.11","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"This vulnerability has been discovered internally by GitLab team member Terri Chu"}],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-14T05:33:17.465Z","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","shortName":"GitLab"},"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/591964"},{"url":"https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/"}],"solutions":[{"lang":"en","value":"Upgrade to versions 18.9.7, 18.10.6, 18.11.3 or above."}],"title":"Missing Authorization in GitLab"}},"cveMetadata":{"assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","assignerShortName":"GitLab","cveId":"CVE-2026-8144","datePublished":"2026-05-14T05:33:17.465Z","dateReserved":"2026-05-07T21:33:23.838Z","dateUpdated":"2026-05-14T05:33:17.465Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-14 06:16:25","lastModifiedDate":"2026-05-14 06:16:25","problem_types":["CWE-862","CWE-862 CWE-862: Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"8144","Ordinal":"1","Title":"Missing Authorization in GitLab","CVE":"CVE-2026-8144","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"8144","Ordinal":"1","NoteData":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.","Type":"Description","Title":"Missing Authorization in GitLab"}]}}}