CVE-2019-5466: GitLab

Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days.

An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.

Affected products

• GitLab GitLab: from 11.5.0, before 11.11.7 (fixed in 11.11.7)

Published 2020-01-28. Last modified 2026-06-17.