CVE-2026-82632

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.9 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1

Description An incorrect authorization of the import target namespace allows an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces that are beyond the intended scope of the token.

Recommendations Update GitLab CE/EE versions 18.9 through 19.2.7 to version 19.2.8. Update GitLab CE/EE versions 19.3 through 19.3.4 to version 19.3.5. Update GitLab CE/EE versions 19.4 through 19.4.1 to version 19.4.2.