Executive brief
GitLab is a platform used by organizations to manage software code and project collaboration. A security flaw was found where a user with restricted 'read-only' access could bypass security controls to create issues or post comments in private projects they should not be able to modify. This could lead to unauthorized data entry or information disclosure within sensitive internal projects.
Technical details
An improper authorization vulnerability (CWE-840) exists in GitLab CE/EE versions 16.0 through 18.11.3. The flaw allows an authenticated attacker using an OAuth application with only 'read_api' scopes to perform write actions, specifically creating issues and adding comments within private projects. This bypasses the intended scope restrictions of the OAuth token. The attack requires network access and a valid low-privileged account. GitLab has released patches in versions 18.9.7, 18.10.6, and 18.11.3 to address this logic error.
Affected products
- GitLab GitLab Community Edition (CE) 16.0 to <18.9.7, 18.10 to <18.10.6, 18.11 to <18.11.3
- GitLab GitLab Enterprise Edition (EE) 16.0 to <18.9.7, 18.10 to <18.10.6, 18.11 to <18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.11.3, 18.10.6, and 18.9.7.
- 2026-05-14: disclosed: CVE-2026-1322 published.