CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

CVE-2026-18244

GitLab EE remediation: CVE-2026-18244 affects all GitLab EE versions 17.7–before 19.0.6, 19.1–before 19.1.4, and 19.2–before 19.2.2, where an authenticated user could view restricted group settings due to improper authorization checks on a group settings page. The CVSS 3.1 base score is 4.3 (Medi...

CVE-2026-18244 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...

PT-2026-71213

Name of the Vulnerable Software and Affected Versions GitLab EE versions 15.6 through 19.0.5 GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An incorrect privilege assignment occurs because the system does not account for membership state. Under certain...

CVE-2025-9486: Incorrect Privilege Assignment

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

CVE-2026-19228: Authorization Bypass Through User-Controlled Key

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information...

GitLab 16.0 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-4879)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated...

CVE-2026-16494: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a proje...

PT-2026-71216

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user can modify project settings that are normally restricted to roles with higher privileges. This occurs due to...

PT-2026-71217

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user could read policy configuration belonging to a namespace they were not authorized to access. This occurs due ...

CVE-2026-18433: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

CVE-2026-4879: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to...

PT-2026-71227

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.0 through 19.0.5 GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user can bypass IP-based access restrictions to read limited merge request...

PT-2026-71222

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.0 through 19.0.5 GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user with developer-role permissions can view external status check...

PT-2026-71203

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.5 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where improper input validation could allow an unauthenticated user to cause a denial of...

CVE-2026-6821: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a...

PT-2026-71219

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user could cause AI usage to be attributed to another namespace. This occurs due to improper authorization of...

PT-2026-71198

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description Improper authorization in pipeline reference validation allows an authenticated user with developer-role...

PT-2026-71200

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.7 through 19.0.5 GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1 Description An improper authorization check on a group settings page allows an authenticated user to view restricted...

CVE-2026-18244: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group...