CVE-2026-6821

Name of the Vulnerable Software and Affected Versions GitLab EE versions 12.0 through 19.0.5 GitLab EE versions 19.1 through 19.1.3 GitLab EE versions 19.2 through 19.2.1

Description An issue exists where an authenticated user can bypass IP-based access restrictions to read limited merge request information from a private project. This occurs due to missing authorization checks in a merge requests API endpoint.

Recommendations Update GitLab EE versions 12.0 through 19.0.5 to version 19.0.6. Update GitLab EE versions 19.1 through 19.1.3 to version 19.1.4. Update GitLab EE versions 19.2 through 19.2.1 to version 19.2.2.