CRITICAL

CVE-2026-87719

2026-09-12 CVSS v3.1

CVSS

9.9

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

Weakness (CWE)

CWE-502 Deserialization of Untrusted Data

EPSS Score

0.61%

Probability of exploitation in next 30 days

47.9th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/628160 https://hackerone.com/reports/4012289

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE