CVE-2020-26417: GitLab

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.

Affected products

• GitLab GitLab: from 13.1.0, before 13.4.7 (fixed in 13.4.7); from 13.5.0, before 13.5.5 (fixed in 13.5.5); from 13.6.0, before 13.6.2 (fixed in 13.6.2)

Published 2020-12-11. Last modified 2026-06-17.