CVE-2026-6821: GitLab EE Auth Bypass Vulnerability

CVE-2026-6821 Overview

CVE-2026-6821 is an authorization bypass vulnerability in GitLab Enterprise Edition (EE). The flaw allows an authenticated user to bypass IP-based access restrictions and read limited merge request information from private projects. The root cause is a missing authorization check in a merge requests API endpoint, tracked as [CWE-862].

The issue affects GitLab EE versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Exploitation requires an authenticated account and can be performed over the network without user interaction. GitLab addressed the flaw in patch releases documented in the GitLab Patch Release Notes.

Critical Impact
Authenticated users can bypass IP allowlists and read limited merge request metadata from private projects they should not access.

Affected Products

GitLab EE 12.0 through versions before 19.0.6
GitLab EE 19.1 before 19.1.4
GitLab EE 19.2 before 19.2.2

Discovery Timeline

2026-08-12 - CVE-2026-6821 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-6821

Vulnerability Analysis

The vulnerability resides in a merge requests API endpoint within GitLab EE. The endpoint does not properly enforce authorization checks before returning merge request data. As a result, an authenticated user can query the endpoint and retrieve limited information from private projects.

The flaw also allows attackers to circumvent IP-based access restrictions configured at the group or instance level. IP allowlisting is a common control used by enterprises to restrict GitLab access to trusted networks. When this control fails at a specific API endpoint, attackers outside the allowed IP range can still enumerate merge request metadata.

The scope of exposure is limited to merge request information; the flaw does not permit modification of data or full source code disclosure. Details of the report are tracked in HackerOne Report #3674254 and the internal GitLab Work Item.

Root Cause

The root cause is a missing authorization check [CWE-862] in the merge requests API endpoint. The endpoint validates authentication but omits the follow-up check that confirms the user belongs to the project or falls within permitted IP ranges. Authorization logic that should gate access to private project data is not invoked on this code path.

Attack Vector

An attacker requires a valid, authenticated GitLab account. From an IP address that would normally be blocked by group or instance-level IP restrictions, the attacker issues an HTTP request to the affected merge requests API endpoint. The response returns limited merge request fields from private projects that the attacker should not be able to read.

Exploitation does not require elevated privileges, social engineering, or user interaction. The vulnerability is described in prose because no verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-6821

Indicators of Compromise

Requests to GitLab merge requests API endpoints originating from IP addresses outside configured allowlists.
Authenticated API access patterns where a single user token enumerates merge requests across many private projects the user is not a member of.
Anomalous spikes in GET requests against /api/v4/ merge request paths from low-privileged accounts.

Detection Strategies

Review GitLab production_json.log and api_json.log for merge request API calls, correlating source IP with configured IP allowlists.
Build audit queries that flag users accessing merge request data for projects they are not members of.
Alert on API calls returning 200 OK from endpoints that should have returned 403 Forbidden based on IP restriction policy.

Monitoring Recommendations

Forward GitLab application and audit logs to a centralized SIEM for continuous review.
Monitor account behavior for unusual cross-project enumeration by low-privileged users.
Track authentication events paired with API access from unexpected geolocations or ASNs.

How to Mitigate CVE-2026-6821

Immediate Actions Required

Upgrade GitLab EE to version 19.0.6, 19.1.4, 19.2.2, or later depending on your release branch.
Audit merge request API access logs for evidence of unauthorized reads prior to patching.
Rotate personal access tokens and session credentials for accounts suspected of abuse.

Patch Information

GitLab released fixes in versions 19.0.6, 19.1.4, and 19.2.2. Details are available in the GitLab Patch Release Notes. Administrators should apply the patch matching their current release branch and validate service health after the upgrade.

Workarounds

No official workaround is documented; upgrading to a patched version is the recommended remediation.
As a compensating control, restrict account creation and revoke unused authenticated sessions to reduce the pool of accounts that could exploit the endpoint.
Enforce network-layer controls (such as reverse proxy IP filtering) in front of GitLab where feasible, since application-layer IP restrictions are bypassed by this flaw.

bash

# Example: verify installed GitLab EE version after patching
sudo gitlab-rake gitlab:env:info | grep -i version

# Example: tail the API log to review merge request endpoint activity
sudo tail -f /var/log/gitlab/gitlab-rails/api_json.log \
  | grep merge_requests