docs.gitlab.com
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released CVE-2026-18433
MEDIUM
Incorrect Authorization in GitLab
Record summary
CVE-2026-18433 has a selected CVSS score of 4.3 (medium).
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
GitLabBrowse GitLab / GitLabDefault status: unaffected | CVE List | 19.1 to < 19.1.4 | affected |
| 19.2 to < 19.2.2 | affected |
References
4gitlab.com
https://gitlab.com/gitlab-org/gitlab/-/work_items/607556 HackerOne Bug Bounty Report #3776182Technical descriptionexploitpermissions required
https://hackerone.com/reports/3776182 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-18433