CVE-2026-4879 in GitLab
Summary
by MITRE • 08/12/2026
GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical authorization bypass in GitLab Enterprise Edition affecting multiple version ranges including 16.0 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1. The flaw existed within the merge request API endpoint where external status check configurations were improperly exposed to users with developer roles who should have been restricted from accessing such sensitive information. This authorization failure stems from inadequate access controls that failed to properly validate user permissions before exposing restricted configuration data. The vulnerability aligns with CWE-285 which addresses improper authorization in software systems, specifically targeting scenarios where insufficient access control mechanisms allow unauthorized information disclosure.
The technical implementation of this flaw involved the merge request API endpoint failing to enforce proper role-based access controls when serving external status check configuration data. Users with developer-level permissions could potentially enumerate and view configuration details that should have been restricted to administrators or higher-privileged roles. This type of information disclosure vulnerability provides attackers with insights into the repository's integration configurations, potentially revealing sensitive webhook endpoints, CI/CD pipeline settings, or other operational details that could aid in subsequent attack vectors. The issue demonstrates a fundamental breakdown in GitLab's permission model where the boundary between developer and administrator privileges was incorrectly enforced during API interactions.
From an operational standpoint, this vulnerability could enable malicious actors with developer accounts to gain unauthorized visibility into critical infrastructure configurations that are typically restricted to privileged users. Such information disclosure could facilitate more sophisticated attacks by revealing integration points, authentication mechanisms, or pipeline configurations that might otherwise remain hidden from lower-privileged users. The impact extends beyond simple information disclosure as it potentially enables attackers to craft more targeted attacks against the CI/CD environment, understand system dependencies, and identify potential escalation paths within the GitLab instance. This vulnerability also aligns with ATT&CK technique T1068 which covers privilege escalation through improper access control mechanisms.
The remediation implemented by GitLab addresses this issue through enhanced authorization checks on the affected merge request API endpoint. The fix ensures that external status check configurations are properly validated against user permissions before being exposed to authenticated users, thereby restoring the intended access control boundaries between different role levels. Organizations should immediately upgrade to the patched versions to mitigate this risk, as the vulnerability could be exploited by any authenticated user with developer privileges who might attempt to gather intelligence about restricted system configurations. Security teams should also monitor for potential exploitation attempts through unusual API access patterns or unauthorized enumeration of merge request configurations that could indicate an active attack against this authorization bypass.