CVE-2019-19312

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-05 · updated 2026-06-17

Description

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API.

Affected products

GitLab: from 8.14.0 before 12.3.8; from 12.4.0 before 12.4.5; from 12.5.0 before 12.5.2 — fixed in 12.3.8, 12.4.5, 12.5.2

How to fix

Upgrade to a fixed version: GitLab 12.3.8, 12.4.5, 12.5.2. Check the vendor advisory for mitigations.

References

https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
https://about.gitlab.com/blog/categories/releases/
https://gitlab.com/gitlab-org/gitlab/issues/28802
https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
https://about.gitlab.com/blog/categories/releases/
https://gitlab.com/gitlab-org/gitlab/issues/28802

Get alerted when CVE-2019-19312 or the next vulnerability affects your stack