Incorrect authorization in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-16275
Published: October 13, 2026
Vulnerability identifier: #VU154157
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-16275
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read confidential notes on public projects.
The vulnerability exists due to incorrect authorization checks in the GraphQL notes widget when handling requests for project notes. A remote attacker can request confidential notes through the GraphQL notes widget to read confidential notes on public projects.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-16275
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2