CVE-2026-7492

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Published

Jul 8, 2026, 8:46:33 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.35% · Oct 25, 2026

A flaw was found in GitLab. Under certain conditions, an unauthenticated user could determine the existence of a private project. This information disclosure is possible due to improper authorization controls on cross-project reference pages. This vulnerability allows an attacker to gain sensitive information about private projects. gitlab-ee: gitlab: GitLab: Information disclosure of private project existence via improper authorization Red Hat does not ship or distribute GitLab Community Edition (CE) or Enterprise Edition (EE), the products affected by this flaw. This CVE was matched to Red Hat container images (OpenShift Console, OpenShift Pipelines Console Plugin) solely because they bundle an unrelated third-party npm client library named "gitlab" (node-gitlab, github.com/jdalrymple/node-gitlab), a REST API wrapper for calling a remote GitLab server. This client library does not contain the GitLab server-side authorization logic affected by this vulnerability, and Red Hat products are not affected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.