Improper access control in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-4672
Published: July 29, 2026 / Updated: July 30, 2026
Vulnerability identifier: #VU140486
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-4672
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
GitLab Enterprise Edition
Gitlab Community Edition
GitLab Enterprise Edition
Gitlab Community Edition
Detailed vulnerability description
The vulnerability allows a remote user to access test report contents they are not authorized to view.
The vulnerability exists due to improper access control enforcement in the Pipeline Test Report API when handling API requests. A remote user can send a request to access test report contents they are not authorized to view.
The issue affects users with guest-role permissions under certain conditions.
How to mitigate CVE-2026-4672
Install security update from vendor's website.