CVE-2026-18433: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.4 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18433?
The severity of CVE-2026-18433 is medium with a score of 4.3.
How do I fix CVE-2026-18433?
To fix CVE-2026-18433, upgrade GitLab EE to version 19.1.4 or later, or 19.2.2 or later.
What systems are affected by CVE-2026-18433?
CVE-2026-18433 affects all versions of GitLab EE from 19.1 before 19.1.4 and 19.2 before 19.2.2.
What type of vulnerability is CVE-2026-18433?
CVE-2026-18433 is an incorrect authorization vulnerability that may allow unauthorized access to policy configurations.
What user actions are necessary to exploit CVE-2026-18433?
CVE-2026-18433 requires an authenticated user who can access the affected GitLab instance to potentially exploit the vulnerability.