CVE-2026-16627
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
GitLab CE/EE versions from 19.2 before 19.2.2 have a vulnerability that under certain conditions could allow an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.
Risk Assessment
An authenticated user with developer-role permissions could escalate privileges, potentially leading to unauthorized access to sensitive functions and data in GitLab.
Recommendation
Upgrade GitLab CE/EE to version 19.2.2 or later to fix the vulnerability. Review permissions of users with developer role.
Original NVD description (English source)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.