IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.5High

CVE-2026-16301Incorrect Authorization in GitLab

GitLab GitLab Published: (1 month ago)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

Weakness (CWE): CWE-863

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
GitLab GitLab 18.7 – < 19.2.8, 19.3 – < 19.3.5, 19.4 – < 19.4.2

References and patches

CPE matches (NVD) (6)
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* ≥ 18.7.0 < 19.2.8
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* ≥ 18.7.0 < 19.2.8
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* ≥ 19.3.0 < 19.3.5
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* ≥ 19.3.0 < 19.3.5
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* ≥ 19.4.0 < 19.4.2
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* ≥ 19.4.0 < 19.4.2

Recent CVEs in the same product — GitLab

10.0Critical
CVE-2026-110264

Integer Overflow or Wraparound in GitLab

GitLab GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could hav…

1.3%EPSS
6.8Medium
CVE-2026-12664

Incorrect Authorization in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a proje…

4.3Medium
CVE-2026-13319

Authorization Bypass Through User-Controlled Key in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project p…

3.1Low
CVE-2026-14288

Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a pr…

5.9Medium
CVE-2026-16255

Incorrect Authorization in GitLab

GitLab GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted …