CVE-2026-16275: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which deployments are exposed?
GitLab CE/EE instances are affected if they run a version from 17.4 up to, but excluding, 19.2.8; 19.3 up to, but excluding, 19.3.5; or 19.4 up to, but excluding, 19.4.2. The issue concerns confidential notes on public projects.
Does exploitation require an authenticated GitLab account or user interaction?
No. The reported attack vector is network-accessible and exploitation does not require privileges or user interaction; under certain conditions, an unauthenticated user could read confidential notes.
What should be done to remediate the issue?
Upgrade GitLab CE/EE to 19.2.8, 19.3.5, 19.4.2, or a later release line containing the fix.