docs.gitlab.com
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released CVE-2026-16494
HIGH
Missing Authorization in GitLab
Record summary
CVE-2026-16494 has a selected CVSS score of 7.1 (high).
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
GitLabBrowse GitLab / GitLabDefault status: unaffected | CVE List | 19.1 to < 19.1.4 | affected |
| 19.2 to < 19.2.2 | affected |
References
4gitlab.com
https://gitlab.com/gitlab-org/gitlab/-/work_items/606580 HackerOne Bug Bounty Report #3775445Technical descriptionexploitpermissions required
https://hackerone.com/reports/3775445 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-16494