security_identifier

CVE-2026-87719

CVE identifier for an insecure deserialization flaw in the GraphQL subscription serializer of GitLab Enterprise Edition.

Current clusters

security6 publishers

GitLab's 19.3.2 release closes an unauthenticated arbitrary file read in the commits API

GitLab shipped 19.3.2, 19.2.6 and 19.1 to fix a maximum-severity path traversal that needs no account, plus an Enterprise Edition deserialization bug that needs a Duo Chat user. GitLab.com is already patched.

Publishers:bleepingcomputer.comcyberscoop.comhorizon3.aiscworld.comsecurityweek.comthehackernews.com

Reality

Evidence58
Adoption45
Hype gap+12
Incentives55
Confidence52

build1 publisher

A file.path parameter in GitLab's commit API reads server files before authentication

The fix ships in 19.3.2, 19.2.6 and 19.1.8, and scanning for the flaw started the day after disclosure. Whether you can tell if a read succeeded on your instance depends on whether your proxy logs request bodies.

Publishers:dev.to

Reality

Evidence60
Adoption35
Hype gap−10
Incentives40
Confidence58