CVE-2026-5954: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab releases need remediation?
Affected releases are all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Upgrade to 19.2.8, 19.3.5, 19.4.2, or a later release in the applicable release line.
What access would an attacker need?
Exploitation requires an authenticated GitLab user with low-level privileges. The issue could allow that user, under certain conditions, to download package files from a public project.
What is the potential impact?
The reported impact is unauthorized download of package files associated with public projects. The supplied severity vector rates confidentiality and integrity impact as low and does not indicate an availability impact.