VULNERABILITY INTELLIGENCE

CVE-2019-6996

CVSS score4.3 MEDIUM

EPSS probability0.80%

CISA KEVNot currently listed

Published2019-09-09

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups.

Weakness classification

CWE-269: Improper Privilege Management

Primary references

cve@mitre.org — Release Notes, Vendor Advisory
cve@mitre.org — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory