Is CVE-2026-16255 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16255 being exploited in the wild.

How severe is CVE-2026-16255?

Medium severity, with a CVSS score of 5.9, published 22 October 2026.

Which products and versions are affected?

GitLab Enterprise Edition 12.0 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1.

Is there a fix for CVE-2026-16255?

Yes: fixed in GitLab EE 19.3.6, 19.4.3, 19.5.1, 19.2.9, 19.1.9, 19.0.10, 18.11.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16255 attacked?

It is attacked over the network.

Am I affected by CVE-2026-16255?

Check whether you run GitLab Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16255: GitLab EE incomplete enforcement of SAML/LDAP membership lock

CVE-2026-16255 · Severity: medium · CVSS 5.9 · Published 2026-10-22

GitLab Enterprise Edition has a security control that locks project and group memberships to an organization's identity provider (SAML or LDAP). When this lock was enabled, authenticated users could bypass it by accepting or granting membership based on requests created before the lock took effect, potentially allowing unauthorized access to projects and groups.

Technologies: GitLab Enterprise Edition. Vendors: GitLab.

Quick answers

Is CVE-2026-16255 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16255 being exploited in the wild.
How severe is CVE-2026-16255?: Medium severity, with a CVSS score of 5.9, published 22 October 2026.
Which products and versions are affected?: GitLab Enterprise Edition 12.0 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1.
Is there a fix for CVE-2026-16255?: Yes: fixed in GitLab EE 19.3.6, 19.4.3, 19.5.1, 19.2.9, 19.1.9, 19.0.10, 18.11.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16255 attacked?: It is attacked over the network.
Am I affected by CVE-2026-16255?: Check whether you run GitLab Enterprise Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GitLab EE 19.3.6, 19.4.3, 19.5.1, 19.2.9, 19.1.9, 19.0.10, 18.11.13

Technical details

GitLab EE versions 12.0 through 19.5.0 fail to retroactively enforce instance-wide SAML or LDAP membership locks on pending membership requests created prior to lock enablement. An authenticated attacker can accept or grant group/project memberships via these pre-lock requests, circumventing the identity provider control mechanism. The fix validates lock status at request fulfillment time rather than only at request creation.

Affected products

GitLab GitLab Enterprise Edition 12.0 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1

Timeline

2026-10-22: disclosed
2026-10-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.