CVE-2026-15423

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1

Description Improper authorization in pipeline reference validation allows an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without possessing the necessary push permissions.

Recommendations Update GitLab CE/EE version 19.0 to 19.0.6. Update GitLab CE/EE version 19.1 to 19.1.4. Update GitLab CE/EE version 19.2 to 19.2.2.