Incorrect authorization in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2026-85529
Published: October 13, 2026
Vulnerability identifier: #VU154159
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85529
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read internal notes and confidential system notes on public projects.
The vulnerability exists due to improper authorization in the GraphQL API's note scope handling when processing requests for project notes. A remote attacker can request notes through the GraphQL API to read internal notes and confidential system notes on public projects.
Affected software
Gitlab Community Edition
GitLab Enterprise Edition
GitLab Enterprise Edition
How to mitigate CVE-2026-85529
Install security update from vendor's website.
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2