CVE-2026-4672

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.4 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0

Description An improper access control enforcement in the Pipeline Test Report API allows an authenticated user with guest-role permissions to access test report contents they are not authorized to view. This flaw in the authorization procedure can impact the confidentiality of protected information.

Recommendations Update GitLab CE/EE versions 18.4 through 19.0.4 to version 19.0.5. Update GitLab CE/EE versions 19.1 through 19.1.2 to version 19.1.3. Update GitLab CE/EE versions 19.2 through 19.2.0 to version 19.2.1.