CVE-2026-87719
GitLab Enterprise Edition had a flaw that let an authenticated user with Duo Chat access retrieve sensitive configuration data and credentials via a crafted GraphQL request. The bug could be triggered without user interaction and could compromise confidentiality, integrity, and availability. The issue has been fixed in newer releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
GitLab Enterprise Edition versions 18.3 up to 19.1.7, 19.2 up to 19.2.5, and 19.3 up to 19.3.1. Users running these versions are at risk.
Real-world impact
An attacker who can log in and has Duo Chat permissions could extract advanced search settings and credentials, potentially giving them full control over the GitLab instance.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability can be exploited over the network with low effort, requires only low privileges, and changes the scope of the system, allowing an attacker to gain full confidentiality, integrity, and availability of the GitLab server.
What to do about it
- 011. Upgrade GitLab Enterprise Edition to version 19.1.8 or later, 19.2.6 or later, or 19.3.2 or later.
- 022. Restart GitLab services to apply the update.
NVD-referenced vendor advisory
Timeline
- Sep 12, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 12, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.