CVE-2026-7492 Missing Authorization in GitLab

Medium 4.3 Published 8 Jul 2026 Updated 9 Jul 2026

An unauthenticated attacker can determine the existence of private projects due to improper authorization controls on cross-project reference pages.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-7492?

CVE-2026-7492 is a medium-severity missing authorization vulnerability in Gitlab Gitlab, published on 8 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an unauthenticated user to determine the existence of a private project due to improper authorization controls on cross-project reference pages.

Weakness: CWE-862

Which versions are affected by CVE-2026-7492?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `9.1.0`	`18.11.7, 19.0.4, 19.1.2`

Products include Gitlab Gitlab.

How do I fix CVE-2026-7492?

Upgrade gitlab to a fixed version for your release line: 18.11.7, 19.0.4 or 19.1.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-7492 being exploited?

There is no known exploitation of CVE-2026-7492 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2026-7492, GHSA-pggx-2v9r-j6gm, MINI-2592-w78v-765r, MINI-2wcq-qj8p-hgww, MINI-3q42-h87g-h27w, MINI-44m4-grrp-9xgc and 45 more.