CVE-2026-4879

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.0 through 19.0.5 GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1

Description An issue exists where an authenticated user with developer-role permissions can view external status check configurations that are restricted to higher-privileged roles. This occurs due to missing authorization on a merge request API endpoint.

Recommendations Update GitLab EE versions 16.0 through 19.0.5 to version 19.0.6. Update GitLab EE versions 19.1 through 19.1.3 to version 19.1.4. Update GitLab EE versions 19.2 through 19.2.1 to version 19.2.2.