docs.gitlab.com
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released CVE-2026-6821
MEDIUM
Missing Authorization in GitLab
Record summary
CVE-2026-6821 has a selected CVSS score of 4.3 (medium).
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
GitLabBrowse GitLab / GitLabDefault status: unaffected | CVE List | 12.0 to < 19.0.6 | affected |
| 19.1 to < 19.1.4 | affected | ||
| 19.2 to < 19.2.2 | affected |
References
4gitlab.com
https://gitlab.com/gitlab-org/gitlab/-/work_items/597702 HackerOne Bug Bounty Report #3674254Technical descriptionexploitpermissions required
https://hackerone.com/reports/3674254 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-6821