EUVD-2026-57435
GHSA-3vq6-w6gp-xpph
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable GraphQL endpoint, no special conditions, but authenticated session required (PR:L); impact is read-only policy config disclosure with no integrity or availability effect.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.
AnalysisAI
Incorrect authorization in GitLab Enterprise Edition's GraphQL layer allows authenticated users to read policy configurations belonging to namespaces they have no authorized access to. Affected versions span GitLab EE 19.1 before 19.1.4 and 19.2 before 19.2.2. A publicly available proof-of-concept exploit exists (HackerOne report #3776182), though no active exploitation has been confirmed by CISA KEV, making this a medium-severity information disclosure risk for organizations running GitLab EE at affected patch levels.
Technical ContextAI
GitLab EE exposes a GraphQL API for programmatic access to platform data, including security policy configurations scoped to namespaces (groups or projects). CWE-863 (Incorrect Authorization) describes the root cause: the server correctly authenticates the requesting user but fails to enforce that the user holds the required authorization to access the requested resource. In this case, a specific GraphQL query handler omits or misconfigures namespace-boundary authorization checks, allowing cross-namespace policy data reads. The affected CPE is cpe:2.3:a:gitlab:gitlab covering the EE distribution across versions 19.1.0-19.1.3 and 19.2.0-19.2.1. This class of flaw is distinct from authentication bypass (which bypasses identity verification entirely); here identity is confirmed but access control logic for resource ownership is broken.
RemediationAI
Upgrade GitLab EE to version 19.1.4 or 19.2.2, as documented in the vendor patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/. These are the vendor-confirmed fixed versions per EUVD-2026-57435 and the patch advisory. For organizations unable to immediately upgrade, a compensating control is to restrict GraphQL API access at the network layer to known-trusted IP ranges or internal networks only - this limits the attack surface to authenticated users already within the trusted network perimeter but does not eliminate the flaw. Another targeted measure is to audit current namespace policy configurations for unexpected access patterns in GitLab audit logs. Note that restricting GraphQL broadly may impact CI/CD pipelines and integrations that rely on the API; assess operational impact before applying network-level controls.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today