CVE-2018-19584

GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.

• CWE-639

• https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab-ce/issues/52522Exploit, Vendor Advisory
• https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Release Notes, Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab-ce/issues/52522Exploit, Vendor Advisory

Published

Jul 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19578GitLab EE, version 11.5 before 11.5.1, is vulnerable to an i…
• CVE-2018-19579GitLab EE version 11.5 is vulnerable to a persistent XSS vul…
• CVE-2018-19580All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 …
• CVE-2018-19581GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 befo…
• CVE-2018-19582GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.…
• CVE-2018-19583GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 b…6.5
• CVE-2018-19585GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x…
• CVE-2018-19586Silverpeas 5.15 through 6.0.2 is affected by an authenticate…
• CVE-2018-19587In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c…
• CVE-2018-19588Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Co…
• CVE-2018-19589Incorrect Access Controls of Security Officer (SO) in PKCS11…
• CVE-2018-1959IBM Security Identity Manager 7.0.1 Virtual Appliance contai…5.1