CVE-2026-10518: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.1
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated GitLab EE user with guest-level permissions could exploit the issue, but only under certain conditions. The impact is limited to reading private security policy content that the user was not authorized to access.
Which GitLab EE versions need to be updated?
Affected versions are 17.9 through versions before 19.2.7, 19.3.x before 19.3.3, and 19.4.x before 19.4.1. Update to 19.2.7, 19.3.3, 19.4.1, or a later release as appropriate for your deployment.
What is the impact if the issue is exploited?
The vulnerability provides unauthorized read access to private security policy content. The supplied severity vector indicates low confidentiality impact and no integrity or availability impact.