Authorization Bypass Through User-Controlled Key in GitLab (CVE-2026-19228)
GitLab Enterprise Edition versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1 contain an authorization bypass vulnerability. This flaw could allow an authenticated user to have AI usage incorrectly attributed to another namespace due to improper authorization of identity information in requests. The issue has been remediated in versions 19.1.4 and 19.2.2.
AI Analysis
Technical Summary
CVE-2026-19228 is an authorization bypass vulnerability in GitLab EE affecting versions >=19.1.0 <19.1.4 and >=19.2.0 <19.2.2. Under certain conditions, an authenticated user could manipulate identity information supplied in requests, causing AI usage to be attributed to a different namespace than intended. This occurs due to improper authorization checks on user-controlled keys. The vendor has released patches in versions 19.1.4 and 19.2.2 to address this issue.
Potential Impact
An authenticated user could cause AI usage to be attributed to another namespace, potentially leading to misattribution of actions or resource usage within GitLab. This could affect accountability and auditing within affected GitLab instances.
Mitigation Recommendations
A patch is available and should be applied by upgrading to GitLab EE versions 19.1.4 or later in the 19.1 series, or 19.2.2 or later in the 19.2 series. No additional mitigation steps are indicated by the vendor advisory.
Authorization Bypass Through User-Controlled Key in GitLab (CVE-2026-19228)
Description
GitLab Enterprise Edition versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1 contain an authorization bypass vulnerability. This flaw could allow an authenticated user to have AI usage incorrectly attributed to another namespace due to improper authorization of identity information in requests. The issue has been remediated in versions 19.1.4 and 19.2.2.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19228 is an authorization bypass vulnerability in GitLab EE affecting versions >=19.1.0 <19.1.4 and >=19.2.0 <19.2.2. Under certain conditions, an authenticated user could manipulate identity information supplied in requests, causing AI usage to be attributed to a different namespace than intended. This occurs due to improper authorization checks on user-controlled keys. The vendor has released patches in versions 19.1.4 and 19.2.2 to address this issue.
Potential Impact
An authenticated user could cause AI usage to be attributed to another namespace, potentially leading to misattribution of actions or resource usage within GitLab. This could affect accountability and auditing within affected GitLab instances.
Mitigation Recommendations
A patch is available and should be applied by upgrading to GitLab EE versions 19.1.4 or later in the 19.1 series, or 19.2.2 or later in the 19.2 series. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-gitlab-2026-19228
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-19228"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a8460a2c6e8be033245a85b
Added to database: 08/18/2026, 13:39:46 UTC
Last enriched: 08/18/2026, 13:42:00 UTC
Last updated: 08/18/2026, 13:42:00 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.