CVE-2026-1080: Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint.
Other sources
GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-1080?
CVE-2026-1080 is classified as a high severity vulnerability due to its potential for authorization bypass.
How do I fix CVE-2026-1080?
To remediate CVE-2026-1080, update GitLab EE to version 18.6.6, 18.7.4, or 18.8.4 or later.
What versions are affected by CVE-2026-1080?
CVE-2026-1080 affects GitLab EE versions from 16.7 through 18.8.3.
Can an unauthorized user exploit CVE-2026-1080?
No, CVE-2026-1080 requires authentication to exploit the authorization bypass vulnerability.
Is CVE-2026-1080 resolved in the latest GitLab versions?
Yes, CVE-2026-1080 has been resolved in GitLab EE versions 18.6.6, 18.7.4, and 18.8.4.