GitLabCVE-2026-19228

GitLab: improper authorization

CVE-2026-19228 · Published Aug 12, 2026 · updated Aug 19, 2026

High8.5

Fix: upgrade to 19.1.4 or later (2 fixed versions below)

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 19.1, < 19.1.4	19.1.4
	>= 19.2, < 19.2.2	19.2.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-639

More GitLab advisories

All GitLab

Medium 4.3Aug 12

GitLab: missing authorizationCVE-2026-6821fixed in 19.0.6 +2 Medium 4.3Aug 12

GitLab: missing authorizationCVE-2026-4879fixed in 19.0.6 +2 Medium 4.3Aug 12

GitLab: improper authorizationCVE-2026-18433fixed in 19.1.4 +1 High 7.1Aug 12

GitLab: missing authorizationCVE-2026-16494fixed in 19.1.4 +1 High 8.7Aug 12

GitLab: cross-site scriptingCVE-2026-15216fixed in 19.0.6 +2 High 8.7Aug 12

GitLab: cross-site scriptingCVE-2026-15217fixed in 19.0.6 +2