{"id":"CVE-2019-15590","aliases":["EUVD-2019-6557","GHSA-83w3-58xf-86mr"],"status":"published","title":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition ...","description":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01107,"percentile":0.66298,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2020-01-28T02:31:05Z","modified":"2026-10-30T10:30:23Z","products":[{"vendor":"gitlab","product":"gitlab"},{"vendor":"gitlab","product":"gitlab ee"}],"references":[{"url":"https://hackerone.com/reports/701144","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","report"]},{"url":"https://about.gitlab.com/releases/2019/10/07/security-release-gitlab-12-dot-3-dot-5-released/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15590"},{"url":"https://github.com/advisories/GHSA-83w3-58xf-86mr"}],"sources":{"cve":[{"id":"CVE-2019-15590","description":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration","status":"published","published":"2020-01-28T02:31:05Z","modified":"2024-08-05T00:49:13.635Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:21.703364Z"}],"euvd":[{"id":"EUVD-2019-6557","description":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration","status":"published","published":"2020-01-28T02:31:05Z","modified":"2024-08-05T00:49:13Z","updated_at":"2026-11-03T02:40:35.584574Z"}],"ghsa":[{"id":"GHSA-83w3-58xf-86mr","title":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition ...","description":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration","status":"published","published":"2022-05-24T17:07:32Z","modified":"2023-01-29T05:01:12Z","updated_at":"2026-11-02T14:44:45.404949Z"}],"nvd":[{"id":"CVE-2019-15590","description":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration","status":"published","published":"2020-01-28T03:15:10.717Z","modified":"2026-06-17T02:20:42.157Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"CVE-2019-15590","description":"An access control issue exists in \u003c 12.3.5, \u003c 12.2.8, and \u003c 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration","status":"published","published":"2020-01-28T03:15:10.717Z","modified":"2026-10-30T10:30:23.59028026Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.361782Z"}]}}