Improper access control in GitLab Enterprise Edition - CVE-2026-10518
Published: September 23, 2026
Vulnerability identifier: #VU151881
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-10518
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read private security policy content they are not authorized to access.
The vulnerability exists due to improper authorization enforcement in the GraphQL memberRoles dependentSecurityPolicies resolver when resolving security policies. A remote user can query the resolver to read private security policy content they are not authorized to access.
Exploitation requires guest-level permissions.
Affected software
GitLab Enterprise Edition
How to mitigate CVE-2026-10518
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.7, 19.3.3, 19.4.1