Description

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T20:17:41.723Z",
  "pubdate": "2026-08-12T20:17:41.723Z",
  "executiveSummary": "An authorization bypass vulnerability exists within GitLab EE involving incorrect authorization checks in a GraphQL query. This flaw allows an authenticated user to read policy configuration belonging to a namespace they are not authorized to access. The affected products are GitLab EE versions from 19.1 prior to 19.1.4 and from 19.2 prior to 19.2.2.\nThe risk implications include unauthorized disclosure of sensitive namespace policy configurations, potentially exposing security baselines, compliance rules, or internal governance structures to malicious actors. The attacker capabilities require authenticated access to the GitLab instance, enabling them to query the GraphQL API.\nExploitation requirements include valid user credentials and the capability to craft or issue specific GraphQL queries targeted at unauthorized namespaces. The vulnerability stems from improper access control enforcement at the API layer, bypassing intended security boundaries between distinct namespaces.",
  "technicalDetails": "The root cause of the vulnerability resides in the application logic handling GraphQL queries within GitLab EE. Specifically, the component responsible for processing specific policy configuration queries fails to perform adequate backend authorization checks against the requesting user's permissions relative to the targeted namespace.\nThe affected component is the GraphQL API subsystem handling policy configurations. Vulnerable versions comprise all deployments of GitLab EE from 19.1 before 19.1.4 and from 19.2 before 19.2.2. The vulnerability requires authentication, meaning unauthenticated anonymous access is insufficient to trigger the flaw; however, standard authenticated users with low privileges can exploit it against unauthorized resources.\nThe attack flow proceeds as follows: First, the authenticated attacker formulates a malicious or specially crafted GraphQL query designed to fetch policy configuration data. Second, the attacker transmits this query to the GitLab GraphQL endpoint. Third, due to the flawed authorization logic, the application processes the request without validating whether the authenticated user possesses the necessary read permissions for the specified namespace. Finally, the GraphQL engine retrieves and returns the confidential policy configuration in the API response, granting the unauthorized user visibility into restricted data.\nThe post-exploitation impact is characterized by unauthorized information disclosure. By reading policy configurations across unauthorized namespaces, an attacker can gather intelligence regarding security postures, compliance exceptions, or access control rules, which can then be leveraged to plan subsequent attacks against the organization."
}