CVE-2026-85529

GitLab CE/EE versions 19.2 before 19.2.8 , 19.3 before 19.3.5 , and 19.4 before 19.4.2 are affected by an incorrect authorization vulnerability in the GraphQL API . Under certain conditions, this flaw could allow an unauthenticated user to read internal notes and confidential system notes on publ...