CVE-2026-85529: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab instances are exposed?
GitLab CE/EE instances are affected if they run 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2. Exposure applies under certain conditions where public projects contain internal notes or confidential system notes accessible through the GraphQL API.
Does an attacker need an account or interaction from a project member?
No. The issue could allow an unauthenticated user to read the affected notes, and no user interaction is indicated.
What information could be exposed?
The reported impact is disclosure of internal notes and confidential system notes associated with public projects. The provided information does not indicate modification, deletion, or service-disruption impact.
What version should be deployed to remediate the issue?
Upgrade to GitLab CE/EE 19.2.8, 19.3.5, or 19.4.2, as appropriate for the release line in use.