CVE-2026-4672: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.0.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4672?
The severity of CVE-2026-4672 is medium with a score of 4.3.
Which versions of GitLab are affected by CVE-2026-4672?
CVE-2026-4672 affects GitLab CE/EE versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1.
How do I fix CVE-2026-4672?
To fix CVE-2026-4672, upgrade to GitLab versions 19.0.5, 19.1.3, or 19.2.1 or later.
What type of issue is described in CVE-2026-4672?
CVE-2026-4672 describes a missing authorization issue which allows unauthorized access to certain test report contents.
What user permissions are involved in CVE-2026-4672?
CVE-2026-4672 involves an authenticated user with guest-role permissions accessing restricted content.