Vulnary
← back to the feed
Critical· 9.9official fix available

CVE-2026-87719

GitLab Enterprise Edition had a flaw that let an authenticated user with Duo Chat access retrieve sensitive configuration data and credentials via a crafted GraphQL request. The bug could be triggered without user interaction and could compromise confidentiality, integrity, and availability. The issue has been fixed in newer releases.

publishedSep 12, 2026
last modifiedSep 12, 2026
sourcesNVD
severity · cvss
9.9
critical · how bad it is
exploitation · epss
<1%
47th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 12, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

GitLab Enterprise Edition versions 18.3 up to 19.1.7, 19.2 up to 19.2.5, and 19.3 up to 19.3.1. Users running these versions are at risk.

02

Real-world impact

An attacker who can log in and has Duo Chat permissions could extract advanced search settings and credentials, potentially giving them full control over the GitLab instance.

03

Why this severity

The CVSS score of 9.9 reflects that the vulnerability can be exploited over the network with low effort, requires only low privileges, and changes the scope of the system, allowing an attacker to gain full confidentiality, integrity, and availability of the GitLab server.

04

What to do about it

official fix available
recommended steps
  1. 011. Upgrade GitLab Enterprise Edition to version 19.1.8 or later, 19.2.6 or later, or 19.3.2 or later.
  2. 022. Restart GitLab services to apply the update.

NVD-referenced vendor advisory

05

Timeline

  1. Sep 12, 2026 · 2d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Sep 12, 2026 · 1d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredLow
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →