GitLab EE: authenticated user bypasses IP access restrictions to read private merge request data

Impact

A merge requests API endpoint misses authorization checks, letting an authenticated user read limited merge request information from a private project while bypassing the group's IP-based access restriction. IP allowlisting is the compensating control operators lean on to keep a self-managed GitLab reachable only from management networks or a VPN, so the practical loss here is that the network boundary does not hold on this API path. The data exposed is limited merge request metadata - GitLab scores confidentiality low with no integrity or availability impact. Affects 12.0 before 19.0.6, 19.1 before 19.1.4 and 19.2 before 19.2.2.

Who can reach it

An authenticated GitLab user with network reach to the instance API, calling from an address the group's IP restriction should have blocked. No elevated project role is described.

What to do

Upgrade to 19.0.6, 19.1.4 or 19.2.2 per the GitLab 19.2.2 patch release - a package upgrade and service restart (Omnibus reconfigure/restart or a Helm chart bump), with a short GitLab outage and no fleet impact. Until then, do not treat group IP restrictions as the only boundary in front of the instance; enforce the same restriction at the load balancer or ingress.

References

Related entries

• Jenkins: symlinks with empty names in agent tar archives write arbitrary files on the controllerCVE-2026-70427 · Jenkins controller (tar and tar.gz extraction of agent-supplied archives)Medium
• Jenkins: path traversal in file parameter names writes arbitrary files on the controller filesystemCVE-2026-70428 · Jenkins controller (path traversal in file parameter names)Medium
• GitLab: developer-role user can replace package file content and hide packages from ownersCVE-2026-7514 · GitLab CE/EE (Generic Package Registry authorization)Medium
• Apache Airflow: /assets/events returns asset events for every DAG, ignoring per-DAG access controlCVE-2026-75158 · Apache Airflow core API (/assets/events endpoint)Medium
• HPE OneView: remotely triggerable URL redirect in the management consoleCVE-2026-76720 · HPE OneView (open URL redirect)Medium
• Jenkins core: crafted XML submission lets a read-only user create user objects on the controllerCVE-2026-84646 · Jenkins core (XML deserialization, user objects as nested field values)Medium