Executive brief
GitLab has addressed a security flaw where Project Access Tokens—temporary credentials used to automate tasks—could still access private data even after they were supposed to be blocked. This means a revoked or disabled token might still allow unauthorized access to sensitive project files and code. Organizations using affected versions of GitLab should update immediately to ensure that access controls are properly enforced.
Technical details
An incorrect authorization enforcement vulnerability (CWE-863) exists in GitLab CE/EE versions 18.9 through 19.0.1. The flaw allows a Project Access Token that has been administratively blocked to continue accessing private resources under specific conditions. This is a network-reachable vulnerability requiring low privileges (possession of the blocked token). The issue stems from a failure in the authorization logic to re-validate the token's status against the block list during active sessions or specific API calls. Patches have been released in versions 18.10.7, 18.11.4, and 19.0.1.
Affected products
- GitLab GitLab Community Edition (CE) 18.9 to < 18.10.7, 18.11 to < 18.11.4, 19.0 to < 19.0.1
- GitLab GitLab Enterprise Edition (EE) 18.9 to < 18.10.7, 18.11 to < 18.11.4, 19.0 to < 19.0.1
Timeline
- 2026-05-27: patched: GitLab released versions 18.10.7, 18.11.4, and 19.0.1 to address the issue.
- 2026-05-28: disclosed: CVE-2026-9807 was published.