CVE-2019-19312: GitLab

Medium severity, CVSS 5.8. EPSS: 1.1% chance of exploitation in the next 30 days.

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API.

Affected products

• GitLab GitLab: from 8.14.0, before 12.3.8 (fixed in 12.3.8); from 12.4.0, before 12.4.5 (fixed in 12.4.5); from 12.5.0, before 12.5.2 (fixed in 12.5.2)

Published 2020-01-05. Last modified 2026-06-17.