GitLab EE: GraphQL query exposes policy configuration from an unauthorized namespace

Impact

Incorrect authorization checks in a GraphQL query let an authenticated user read policy configuration belonging to a namespace they have no access to. On a self-managed GitLab that gates what reaches the fleet, those policies describe the scanning and approval rules a change must pass, so the exposure tells an attacker with a foothold account which controls exist and where they are weakest. It is read-only - GitLab scores confidentiality low with no integrity or availability impact - and no configuration change is described. Affects 19.1 before 19.1.4 and 19.2 before 19.2.2.

Who can reach it

Any authenticated GitLab user who can issue GraphQL queries against the instance. No membership in the target namespace and no elevated role is required.

What to do

Upgrade to 19.1.4 or 19.2.2 per the GitLab 19.2.2 patch release - a package upgrade and service restart (Omnibus reconfigure/restart or a Helm chart bump), with a short GitLab outage and no GPU node impact.

References

Related entries

• NetApp ONTAP S3 NAS bucket directory listing: An authenticated S3 user lists the contents of directories they have noCVE-2026-22052 · NetApp ONTAP S3 NAS bucket directory listingMedium
• GitLab EE: developer-role user can read external status check configuration for a merge requestCVE-2026-4879 · GitLab EE (merge request external status check API)Medium
• Jenkins: post-login redirect accepts URLs with tab or newline between slashes, enabling phishingCVE-2026-53437 · Jenkins core (post-login redirect URL validation)Medium
• GitLab EE: authenticated user bypasses IP access restrictions to read private merge request dataCVE-2026-6821 · GitLab EE (merge requests API, IP-based access restrictions)Medium
• Jenkins: symlinks with empty names in agent tar archives write arbitrary files on the controllerCVE-2026-70427 · Jenkins controller (tar and tar.gz extraction of agent-supplied archives)Medium
• Jenkins: path traversal in file parameter names writes arbitrary files on the controller filesystemCVE-2026-70428 · Jenkins controller (path traversal in file parameter names)Medium