CVE-2026-12910: Missing Authentication for Critical Function in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.1.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.2.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.3.2
Event History
Frequently Asked Questions
Which GitLab deployments are affected?
GitLab CE and EE are affected if they run versions from 18.6 before 19.1.8, 19.2 before 19.2.6, or 19.3 before 19.3.2. The issue applies only under certain conditions involving SAML SSO sign-in restrictions.
What access does an attacker need?
An attacker must already be an authenticated GitLab user. The reported impact is the ability to bypass SAML SSO sign-in restrictions and authenticate without SSO.
What should teams do to remediate the issue?
Upgrade to GitLab 19.1.8, 19.2.6, 19.3.2, or a later release in the applicable release line. The provided information does not identify a workaround for deployments that cannot be upgraded immediately.