CVE-2019-5466 - An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names

MEDIUM

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names

Published Jan 28, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.97%

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.

Vendor n/a Product GitLab CE/EE Default
unknown
Affected
- Affects GitLab CE/EE 11.5 and later
- Fixed in 12.1.2 in 12.0.4 and in 11.11.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	GitLab CE/EE	unknown	Affected Affects GitLab CE/EE 11.5 and later Fixed in 12.1.2 in 12.0.4 and in 11.11.6

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

Link	Providers	Tags
https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/		x_refsource_MISCPatchRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15048		Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/59809		x_refsource_MISCExploitVendor Advisory
https://hackerone.com/reports/507113		x_refsource_MISCPermissions Required

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Jan 28, 2020

Updated Aug 4, 2024

Reserved Jan 4, 2019

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner hackerone

Published Jan 28, 2020

Updated Aug 4, 2024

GitHub

No data