Authorization Flaw in GitLab EE Leading to Project Setting Modifications
CVE-2026-16494

7.1HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
12 August 2026

What is CVE-2026-16494?

GitLab EE has a security vulnerability that affects versions prior to 19.1.4 and 19.2.2, which may allow an authenticated user to gain unauthorized access to modify project settings typically restricted to users with higher privileges. This issue arises from insufficient authorization checks on the project update endpoint, enhancing the risk of project configuration manipulation.

Affected Version(s)

GitLab 19.1 < 19.1.4

GitLab 19.2 < 19.2.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/606580
https://hackerone.com/reports/3775445
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [3nvz](https://hackerone.com/3nvz) for reporting this vulnerability through our HackerOne bug bounty program
.