CVE-2026-16255: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.6
Event History
Frequently Asked Questions
Which environments are exposed?
GitLab EE instances are affected if they use an instance-wide SAML or LDAP membership lock and run a vulnerable version: 12.0 through before 19.3.6, 19.4 through before 19.4.3, or 19.5 through before 19.5.1.
What does an attacker need to exploit this issue?
The attacker must be an authenticated user. Exploitation depends on membership-related requests having been created before the instance-wide SAML or LDAP membership lock was enabled.
Does enabling the membership lock fully prevent this issue?
Not for membership requests that already existed when the lock was enabled. The incomplete enforcement applied to requests created before the lock, allowing project or group membership to be granted or accepted outside the identity provider's control.
What should administrators check if they cannot patch immediately?
Review outstanding or previously created project and group membership requests that predate enablement of the instance-wide SAML or LDAP membership lock. Check whether any memberships were granted or accepted outside the identity provider's intended control.