CVE-2019-15590

An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration

• CWE-284

• https://about.gitlab.com/releases/2019/10/07/security-release-gitlab-12-dot-3-dot-5-released/Vendor Advisory
• https://hackerone.com/reports/701144Permissions Required, Third Party Advisory
• https://about.gitlab.com/releases/2019/10/07/security-release-gitlab-12-dot-3-dot-5-released/Vendor Advisory
• https://hackerone.com/reports/701144Permissions Required, Third Party Advisory

Published

Jan 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15585Improper authentication exists in < 12.3.2, < 12.2.6, and < …9.8
• CVE-2019-15586A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin…6.1
• CVE-2019-15587In the Loofah gem for Ruby through v2.3.0 unsanitized JavaSc…5.4
• CVE-2019-15588There is an OS Command Injection in Nexus Repository Manager…7.2
• CVE-2019-15589An improper access control vulnerability exists in Gitlab <v…8.8
• CVE-2019-1559If an application encounters a fatal protocol error and then…5.9
• CVE-2019-15591An improper access control vulnerability exists in GitLab <1…6.5
• CVE-2019-15592GitLab 12.2.2 and below contains a security vulnerability th…4.3
• CVE-2019-15593GitLab 12.2.3 contains a security vulnerability that allows …6.5
• CVE-2019-15594GitLab 11.8 and later contains a security vulnerability that…4.3
• CVE-2019-15595A privilege escalation exists in UniFi Video Controller =<3.…8.8
• CVE-2019-15596A path traversal in statics-server exists in all version tha…7.5