CVE-2020-26412: GitLab

Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days.

Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.

Affected products

• GitLab GitLab: from 13.2.0, before 13.6.2 (fixed in 13.6.2)

Published 2020-12-11. Last modified 2026-06-17.