CVE-2026-16275

A vulnerability in GitLab CE/EE allows an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation. Affects versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE allows an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE allows an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE allows an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events. Affects versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an individual with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

GitLab CE/EE versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

GitLab CE/EE versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.

Multiple versions of GitLab expose a dangerous method that could lead to the deletion of all Issue and MergeRequest objects by any authenticated user. For publicly available projects, this vulnerability could be exploited by unauthenticated users.