GitLabCVE-2026-16255

GitLab: improper authorization

CVE-2026-16255 · Published Oct 22, 2026 · updated Oct 30, 2026

Medium5.9

Fix: upgrade to 19.3.6 or later (3 fixed versions below)

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 12.0, < 19.3.6	19.3.6
	>= 19.4, < 19.4.3	19.4.3
	>= 19.5, < 19.5.1	19.5.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-863

More GitLab advisories

All GitLab

Medium 6.8Oct 22

GitLab: improper authorizationCVE-2026-12664fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: missing authorizationCVE-2026-13319fixed in 19.3.6 +2 Low 3.1Oct 22

GitLab: improper access controlCVE-2026-14288fixed in 19.3.6 +2 High 8.2Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1...CVE-2026-15723fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: authenticated user could access paid AI features withoutCVE-2026-112378fixed in 19.3.6 +2 Low 2.7Oct 22

GitLab: improper authorizationCVE-2026-103515fixed in 19.3.6 +2