CVE-2026-8472: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to missing authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.11.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.0.4 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8472?
The severity of CVE-2026-8472 is medium, with a score of 4.3.
How do I fix CVE-2026-8472?
To fix CVE-2026-8472, upgrade GitLab EE to versions 18.11.7, 19.0.4, or 19.1.2 or later.
What is the impact of CVE-2026-8472?
CVE-2026-8472 allows an authenticated user with minimal access to read work item metadata from private projects.
Which versions of GitLab are affected by CVE-2026-8472?
CVE-2026-8472 affects GitLab EE versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.
What conditions must be met for CVE-2026-8472 to be exploited?
CVE-2026-8472 can be exploited under certain conditions where an authenticated user has minimal access permissions.