CVE-2026-6821

Analyzed Analyzed - Analysis Complete

Authentication Bypass in GitLab EE via Merge Request API

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-6821

EUVD

EUVD-2026-57440

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 19.1.0 (inc) to 19.1.4 (exc)
gitlab	gitlab	From 19.2.0 (inc) to 19.2.2 (exc)
gitlab	gitlab	From 12.0.0 (inc) to 19.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab EE allows an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

Detection Guidance

This vulnerability involves missing authorization checks in GitLab EE's merge requests API endpoint. To detect it, check GitLab server logs for unusual API access patterns or unauthorized requests to merge request endpoints. Look for logs indicating access to private project data by authenticated users who shouldn't have permission. Verify that IP-based access restrictions are properly enforced in your GitLab configuration.

Impact Analysis

An attacker with valid credentials could access sensitive merge request details from private projects they should not be able to view, potentially leading to information leaks or unauthorized data exposure.

Compliance Impact

This vulnerability could lead to unauthorized access to private project data, which may violate data protection requirements under GDPR or HIPAA if sensitive information is exposed.

Mitigation Strategies

Upgrade GitLab EE to version 19.0.6, 19.1.4, or 19.2.2 or later to address the missing authorization checks in the merge requests API endpoint.

Hi! I’m here to help you understand CVE-2026-6821. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70