Description
GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.
Published: 2026-08-12
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

GitLab Enterprise Edition contains an improper authorization check on a group settings page. The bug can allow an authenticated user to view configuration settings that are intended to be restricted, leading to possible exposure of sensitive configuration data. This flaw is classified as an authorization bypass (CWE‑862).

Affected Systems

All GitLab EE instances from version 17.7 through 18.x, 19.0.5, 19.1.3, and 19.2.1 are vulnerable. The vendor recommendation is to upgrade to version 19.0.6, 19.1.4, 19.2.2, or any later release. The affected product is GitLab EE (Enterprise Edition).

Risk and Exploitability

The CVSS score of 4.3 indicates moderate impact, and the EPSS score is currently unavailable, meaning no quantified likelihood of exploitation is provided. Because the flaw requires an authenticated user and is not listed in CISA’s KEV catalog, the exploitation probability appears to be low. The most likely attack scenario involves a legitimate user with access to the group settings page exploiting the missing authorization check.

Generated by OpenCVE AI on August 12, 2026 at 22:41 UTC.

Remediation

Vendor Solution

Upgrade to versions 19.0.6, 19.1.4, 19.2.2 or above.

OpenCVE Recommended Actions

  • Apply the official GitLab EE patch by upgrading to version 19.0.6, 19.1.4, 19.2.2 or any newer release.
  • Revoke or restrict permissions for users who should not have access to group configuration pages, ensuring only administrators retain full view rights.
  • If an immediate upgrade is infeasible, enforce role‑based access controls to block non‑admin users from the group settings page until the patch has been applied.

Generated by OpenCVE AI on August 12, 2026 at 22:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.
Title Missing Authorization in GitLab
First Time appeared Gitlab
Gitlab gitlab
Weaknesses CWE-862
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Gitlab Gitlab
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-08-13T15:03:21.129Z

Reserved: 2026-07-29T14:34:29.604Z

Link: CVE-2026-18244

cve-icon Vulnrichment

Updated: 2026-08-13T15:03:16.470Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-12T18:17:28.127

Modified: 2026-08-19T15:58:58.680

Link: CVE-2026-18244

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T22:45:10Z

Weaknesses