Improper access control in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-6267
Published: July 29, 2026 / Updated: July 30, 2026
Vulnerability identifier: #VU140475
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-6267
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access unauthorized information.
The vulnerability exists due to improper access control in Workhorse internal request handling when processing internal requests. A remote user can send a crafted request to access unauthorized information.
The issue affects authenticated users with the Developer role under certain conditions.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-6267
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1
Gitlab Community Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1
Gitlab Community Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1