Skip to main content

GitLab EE CVE-2026-19228

| EUVDEUVD-2026-57434 HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-12 GitLab GHSA-7q96-xw9j-34hj
Gitlab Authentication Bypass
8.5
CVSS 3.1 · Vendor: GitLab
Share

Severity by source

Vendor (GitLab) PRIMARY
8.5 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
vuln.today AI
7.1 HIGH

AC:H reflects the advisory's explicit 'under certain conditions' qualifier, which implies undisclosed prerequisites; all other metrics align with the described network-accessible, authenticated, cross-namespace integrity bypass.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
Low

Lifecycle Timeline

3
Patch available
Aug 12, 2026 - 20:03 EUVD
Analysis Generated
Aug 12, 2026 - 19:48 vuln.today
CVE Published
Aug 12, 2026 - 19:04 cve.org
HIGH 8.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

Articles & Coverage 2

News 6 New GitLab Vulnerabilities - 6 High Severity, 5 With POC Aug 13, 2026 News 6 New GitLab Vulnerabilities - 6 High Severity, 5 With POC Aug 12, 2026

AnalysisAI

Improper authorization of namespace identity in GitLab Enterprise Edition 19.1.x and 19.2.x allows an authenticated low-privilege user to attribute AI feature usage to arbitrary namespaces they do not own, crossing organizational authorization boundaries within a multi-tenant deployment. The flaw, classified as CWE-639, arises because user-supplied identity information in requests is insufficiently validated before being used to authorize namespace-scoped AI operations, producing a scope change that affects namespaces beyond the attacker's own. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to GitLab EE as low-privilege user
Delivery
Identify target namespace to abuse
Exploit
Craft AI feature request with forged namespace identity
Execution
Bypass namespace authorization check (CWE-639)
Impact
AI usage attributed and billed to victim namespace
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session on the GitLab EE instance with at least low-level privileges (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 8.5 score is substantially elevated by S:C and I:H, but the real-world business impact is AI usage fraud and namespace billing manipulation rather than code execution, credential theft, or data exfiltration - which meaningfully tempers urgency relative to the raw score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated GitLab EE user with minimal permissions - such as a guest-level external contributor - submits a request to an AI-enabled endpoint (e.g., a GitLab Duo code suggestion API call) while supplying a manipulated namespace identifier pointing to a target organization they do not belong to. No public exploit code exists at time of analysis, but the network-accessible attack vector and absence of required user interaction mean a technically capable insider or contractor could discover this through systematic API testing. …
Remediation The primary remediation is to upgrade GitLab EE to version 19.1.4 for deployments on the 19.1.x branch, or to version 19.2.2 for deployments on the 19.2.x branch, as documented in the vendor patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all GitLab Enterprise Edition deployments and confirm whether versions 19.1.x or 19.2.x are in production use, specifically checking which namespaces have AI features enabled. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitlab

View all
CVE-2021-22205 CRITICAL POC
10.0 Apr 23

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
CVE-2023-7028 CRITICAL POC
10.0 Jan 12

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
CVE-2013-4490 MEDIUM POC
6.5 May 13

The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
CVE-2022-2992 CRITICAL POC
9.9 Oct 17

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
CVE-2018-18843 CRITICAL POC
10.0 Dec 04

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
CVE-2024-45409 CRITICAL POC
9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
CVE-2022-1162 CRITICAL POC
9.8 Apr 04

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
CVE-2022-0735 CRITICAL POC
9.8 Mar 28

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
CVE-2021-22175 CRITICAL POC
9.8 Jun 11

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
CVE-2021-22203 CRITICAL POC
9.8 Apr 02

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
CVE-2019-15741 CRITICAL POC
9.8 Sep 16

An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2019-6960 CRITICAL POC
9.8 Sep 09

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-19228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy