Description

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T20:17:44.850Z",
  "pubdate": "2026-08-12T20:17:44.850Z",
  "executiveSummary": "A missing authorization vulnerability has been identified within the merge request API endpoint of GitLab EE, which under specific conditions could allow unauthorized viewing of sensitive configuration data.\nThe flaw specifically involves the exposure of external status check configurations that are normally restricted exclusively to higher-privileged roles within the application.\nThe affected systems include all versions of GitLab EE from 16.0 prior to 19.0.6, 19.1 prior to 19.1.4, and 19.2 prior to 19.2.2.\nThe primary risk implication is unauthorized information disclosure, potentially revealing internal architectural endpoints, webhook secrets, or integration details associated with external status checks.\nTo exploit this vulnerability, an attacker must possess authenticated access with developer-role permissions, meaning anonymous or unauthenticated actors cannot leverage this flaw.\nNo additional complex exploitation requirements or prior system compromises are necessary beyond holding the requisite developer-level privileges within the targeted project context.",
  "technicalDetails": "The root cause of the vulnerability stems from an access control enforcement failure within a specific merge request API endpoint in GitLab EE.\nThe vulnerable component fails to properly validate whether the requesting user possesses the necessary administrative or maintainer-level role permissions before returning sensitive configuration payloads.\nThe affected product versions span GitLab EE 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.\nAuthentication is strictly required to reach the vulnerable API endpoint, meaning the attack vector is limited to authenticated users.\nThe privilege requirement mandates that the executing user holds a developer-role within the project scope, which is insufficient to view restricted external status check configurations under normal security boundaries.\nThe attack flow proceeds as follows: First, an authenticated malicious or compromised user with developer permissions targets the vulnerable merge request API endpoint. Second, the user issues a crafted API request designed to query external status check configurations associated with a specific merge request or project resource. Third, due to the absence of robust server-side role validation, the application processes the request and bypasses authorization checks. Finally, the API returns the sensitive external status check configuration data to the unauthorized developer-role user.\nPost-exploitation impact is centered around confidentiality loss, as the retrieved external status check configuration details may contain sensitive URLs, authentication tokens, or metadata that could facilitate further reconnaissance or targeted secondary attacks against integrated external systems."
}