Medium
Security advisory
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-26417
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:07 UTC · Revision 1
Source evidence
Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.
osv:CVE-2020-26417
Complete source record
{
"id": "8da8a2680dc89fa12a536d999aebbdc8ac23db100bf41a3d98c4e6c24d976ab0",
"url": "https://osv.dev/vulnerability/CVE-2020-26417",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-26417",
"summary": "Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.",
"evidence": "osv:CVE-2020-26417",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-26417",
"aliases": [
"BIT-gitlab-2020-26417",
"CVE-2020-26417"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.com/gitlab-org/gitlab",
"type": "GIT",
"events": [
{
"introduced": "1fa237df2f46d34bd56dd8d018183c756094c2e0"
},
{
"fixed": "f23895b2190f1d72d96ada15463ab8e20abead5b"
},
{
"introduced": "2f8ec2ebf58d8d4885127b9715b143e6756f2df1"
},
{
"fixed": "2e75f6e5b161b73e2ba28508c656854a66793d95"
},
{
"introduced": "c050e8fb184690b8c4cc4c2a5c233f312d713b09"
},
{
"fixed": "98aab73cbd597dab5b0f1ab4b40dc160b0d2e26f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "13.1.0"
},
{
"fixed": "13.4.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "13.1.0"
},
{
"fixed": "13.4.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "13.5.0"
},
{
"fixed": "13.5.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "13.5.0"
},
{
"fixed": "13.5.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"range": [
{
"introduced": "13.6.0"
},
{
"fixed": "13.6.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "13.6.0"
},
{
"fixed": "13.6.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v13.6.1-ee",
"v13.5.4-ee",
"v13.6.0-ee",
"v13.5.3-ee",
"v13.5.1-ee",
"v13.5.0-ee"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26417.json"
}
}
],
"modified": "2026-10-30T10:30:54.283913660Z",
"provider": "osv",
"references": [
"https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26417.json",
"https://gitlab.com/gitlab-org/gitlab/-/issues/282539"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-26417",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436900,
"published_at": "2020-12-11T04:15:11.767+00:00"
}