Improper access control in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-12664
Published: October 22, 2026
Vulnerability identifier: #VU157241
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-12664
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to retrieve a project's incoming email address and create work items despite read-only token restrictions.
The vulnerability exists due to insufficient scope enforcement in the GraphQL work item email address field when processing queries authorized with a read_api-scoped token. A remote user can query the field using such a token to obtain the project's incoming email address and use it to create work items outside the token's permitted scope.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-12664
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1
Gitlab Community Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1
Gitlab Community Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1