CVE-2026-16494
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 have a remediated issue that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.
Risk Assessment
An authenticated user with lower privileges could change critical project settings, potentially leading to integrity and confidentiality breaches of project data.
Recommendation
Upgrade GitLab EE to version 19.1.4 or 19.2.2 (or later) and check for unauthorized changes to project settings.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.