GitLab: read_api OAuth tokens can create issues and comments in private projects

Impact

An OAuth application granted only the read_api scope can still create issues and add comments in private projects. A token handed out for read-only integrations, such as dashboards, bots or CI reporting, can therefore write to projects that hold infrastructure and pipeline code. The record describes improper authorization on issue and comment writes. It does not describe changes to code or pipelines.

Who can reach it

Authenticated user holding a read_api-scoped OAuth token for a GitLab instance, with network access to the GitLab API.

What to do

Upgrade self-managed GitLab to 18.9.7, 18.10.6 or 18.11.3 (or later), depending on your release line. This is a standard GitLab package upgrade with service restart. Affected versions run from 16.0 up to those releases. Review the read_api OAuth applications in use for unexpected issue or comment activity.

References

Related entries

• N-able N-central: Incomplete patch for CVE-2026-18556CVE-2026-18577 · N-able N-centralHigh
• VMware Aria Operations (command injection during assisted migration): An unauthenticated attacker injects commandsCVE-2026-22719 · VMware Aria Operations (command injection during assisted migration)High
• Grafana Snowflake datasource: query access allows reading and writing files on the Grafana serverCVE-2026-28381 · Grafana Snowflake datasource (GET/PUT file commands)High
• Apache Airflow: any authenticated task instance can read or decide another task instance's HITL approvalsCVE-2026-30911 · Apache Airflow Execution API (Human-in-the-Loop endpoints)High
• GitLab CE/EE: missing CSRF protection lets an unauthenticated attacker run GraphQL mutations as a logged-in userCVE-2026-4922 · GitLab CE/EE (GraphQL API CSRF protection)High
• Airflow Google provider: GCS object names with .. segments write outside the destination pathCVE-2026-49297 · Apache Airflow Google provider (GCSToSFTPOperator, GCSTimeSpanFileTransformOperator path handling)High