CVE-2026-5377

CVE-2026-5377 is an access control vulnerability in GitLab Community and Enterprise Edition versions 18.11 before 18.11.1 that enables authenticated users to view titles of confidential or private issues in public projects through improper authorization checks in the issue description rendering process. The vulnerability affects a specific window of GitLab releases and has been remediated in version 18.11.1 and later. The vulnerability carries a CVSS v3.1 score of 4.3 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials, resulting in limited confidentiality impact without affecting integrity or availability. The attack requires low-privileged authenticated access and no user interaction to execute. There is currently no evidence of active exploitation in the wild, with no available public exploit code and no presence on the Known Exploited Vulnerabilities catalog. The vulnerability maintains a low profile within the security community, indicated by an EPSS score of 0.000120000 and an inactive status on vendor hotlists, suggesting minimal immediate threat to deployed systems once patched.