---
id: CVE-2026-87719
title: >-
  GitLab has remediated an issue in GitLab EE affecting all versions from 18.3
  before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6,
  and 19.3 before 19.3.2 that under certain conditions could allow an
  authenticated u…
summary: >-
  GitLab has remediated an issue in GitLab EE affecting all versions from 18.3
  before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6,
  and 19.3 before 19.3.2 that under certain conditions could allow an
  authenticated u…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-502
vendor: GitLab
product: GitLab
affected:
  - GitLab >= 18.3 < 18.11.12
  - GitLab >= 19.0 < 19.0.9
  - GitLab >= 19.1 < 19.1.8
  - GitLab >= 19.2 < 19.2.6
  - GitLab >= 19.3 < 19.3.2
published: '2026-09-12'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T22:16:59.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87719'
references:
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/work_items/628160'
    label: cve@gitlab.com
  - url: 'https://hackerone.com/reports/4012289'
    label: cve@gitlab.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T12:53:28.292076Z'
epss: 0.00571
epssPercentile: 0.44812
ingestedAt: '2026-09-14T15:23:07.430Z'
---

## Overview

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.