Missing Authorization in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-6567
Published: October 13, 2026
Vulnerability identifier: #VU154162
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-6567
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read restricted CI artifact report content without authorization.
The vulnerability exists due to missing authorization checks in the merge request accessibility report comparison endpoint when handling report comparison requests. A remote user can request report content through the comparison endpoint to read restricted CI artifact report content without authorization.
Exploitation requires the Reporter role.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-6567
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2