CVE-2026-6567: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab instances require remediation?
GitLab CE/EE instances running versions from 13.8 up to, but not including, 19.2.8; versions 19.3.x before 19.3.5; or versions 19.4.x before 19.4.2 are affected.
What access does an attacker need?
An attacker must be authenticated to GitLab and have the Reporter role. No user interaction is required.
What could an affected Reporter access?
Under certain conditions, a Reporter could access restricted CI artifact report content that they were not authorized to view. The stated impact is limited to confidentiality.