CVE-2026-2104

CVE-2026-2104 is an authorization bypass vulnerability affecting GitLab Community Edition and Enterprise Edition versions 18.2 through 18.10.2. The flaw allows authenticated users to access confidential issues assigned to other users through the CSV export functionality due to insufficient authorization validation checks. GitLab has released patches in versions 18.8.9, 18.9.5, and 18.10.3 to remediate this issue. The vulnerability carries a CVSS 3.1 score of 4.3 (Medium severity) with a network attack vector, low complexity, and low privilege requirements. The attack requires user authentication and results in limited confidentiality impact, as the unauthorized disclosure is restricted to issue data. The EPSS score of 0.00014 indicates this vulnerability has minimal probability of exploitation in the wild, positioning it below the 28th percentile of all CVEs by exploitability. There is currently no evidence of active exploitation, no public exploit code availability, and the vulnerability is not tracked on the Known Exploited Vulnerabilities (KEV) catalog. Community attention remains low, with the Hot List status marked as inactive. Organizations should prioritize patching based on standard update schedules rather than urgent remediation timelines, though users relying on confidential issue management should apply available updates within normal maintenance windows.