CVE-2026-4672: GitLab CE/EE Auth Bypass Vulnerability

CVE-2026-4672 Overview

CVE-2026-4672 is an improper access control vulnerability [CWE-862] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. Under certain conditions, an authenticated user with guest-role permissions can access test report contents they are not authorized to view. The vulnerability stems from missing authorization checks on test report resources. GitLab has released patched versions to remediate the issue.

Critical Impact
Authenticated guest-role users can read confidential test report contents from projects, exposing information that may include internal test data, failure traces, and code paths intended for higher-privileged roles.

Affected Products

GitLab CE/EE versions 18.4 through versions before 19.0.5
GitLab CE/EE versions 19.1 before 19.1.3
GitLab CE/EE versions 19.2 before 19.2.1

Discovery Timeline

2026-07-29 - CVE-2026-4672 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-4672

Vulnerability Analysis

The vulnerability resides in GitLab's authorization logic for test report resources. GitLab enforces role-based access control (RBAC) across project resources, with Guest being the lowest-privilege project role. Guests are not intended to view CI/CD test report content that may contain sensitive stack traces, logs, or internal identifiers.

Under specific conditions in affected versions, the server-side authorization check for test report contents was not applied correctly. An authenticated user assigned the guest role could then retrieve test report data via the exposed endpoint. Exploitation requires only low privileges and does not require user interaction, but impact is limited to confidentiality of the exposed test report contents.

See the GitLab Patch Release Note and HackerOne Report #3617676 for additional context.

Root Cause

The root cause is a missing authorization check [CWE-862] on the code path that returns test report contents. The permission gate did not verify that the requesting user held a role above Guest before serving the report data. This falls under the broader class of Broken Access Control issues where authentication is validated but authorization is not properly enforced.

Attack Vector

An attacker must first authenticate to the GitLab instance and hold guest-role membership on the target project. From there, the attacker issues an HTTP request to the affected test report endpoint. The server returns report contents without validating that the caller's role is sufficient. No user interaction, elevated privileges, or client-side prerequisites are required.

Refer to GitLab Work Item #594528 for the tracked remediation.

Detection Methods for CVE-2026-4672

Indicators of Compromise

Requests to test report endpoints originating from accounts with Guest project membership in access logs.
Elevated volume of 200 OK responses to test-report API paths from low-privileged tokens or personal access tokens.
Unexpected access to CI/CD artifacts by users who have never interacted with pipelines historically.

Detection Strategies

Audit GitLab production logs for guest-role users retrieving test report resources on private or internal projects.
Correlate production_json.log and api_json.log entries against project membership tables to flag role/resource mismatches.
Baseline normal test-report access patterns per role and alert on deviations, particularly guest accounts issuing repeated report reads.

Monitoring Recommendations

Forward GitLab audit events and API logs to a centralized SIEM for correlation with identity data.
Enable and review GitLab audit events for project_access and resource_access_token activity.
Track upgrade status of all self-managed GitLab instances against the fixed versions 19.0.5, 19.1.3, and 19.2.1.

How to Mitigate CVE-2026-4672

Immediate Actions Required

Upgrade GitLab CE/EE self-managed instances to 19.0.5, 19.1.3, or 19.2.1 depending on the deployed minor version.
Review guest-role memberships across sensitive projects and remove accounts that do not require access.
Rotate personal access tokens and project access tokens tied to guest accounts on affected projects.

Patch Information

GitLab addressed CVE-2026-4672 in versions 19.0.5, 19.1.3, and 19.2.1. GitLab.com SaaS is already running the patched release. Self-managed administrators should apply the update following the GitLab Patch Release Note.

Workarounds

Remove guest-role users from projects containing sensitive CI/CD test report data until the patch is applied.
Restrict CI/CD job artifact and test report visibility settings to project members with Reporter role or higher.
Set project visibility to Private and disable public pipeline results where feasible.

bash

# Verify installed GitLab version and upgrade to a patched release
sudo gitlab-rake gitlab:env:info | grep -i version

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install gitlab-ee=19.2.1-ee.0

# RHEL/CentOS
sudo yum install gitlab-ee-19.2.1-ee.0