Missing Authorization in GitLab (CVE-2026-7492)
Description
A missing authorization vulnerability in GitLab CE/EE allows unauthenticated users to determine the existence of private projects under certain conditions. This issue affects versions from 9.1 up to but not including 18.11.7, 19.0 up to but not including 19.0.4, and 19.1 up to but not including 19.1.2. The vulnerability arises from improper authorization controls on cross-project reference pages. A fix is available for the affected versions.
Affected software
pkg:bitnami/gitlabRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
GitLab CE/EE versions >=9.1.0 <18.11.7, >=19.0.0 <19.0.4, and >=19.1.0 <19.1.2 contain a missing authorization vulnerability (CVE-2026-7492) that could allow an unauthenticated user to confirm the existence of private projects. This occurs due to improper authorization checks on cross-project reference pages. The issue has been remediated in versions 18.11.7, 19.0.4, and 19.1.2 and later.
Potential Impact
An unauthenticated attacker can determine whether a private project exists in the affected GitLab instances. This information disclosure does not grant access to project contents but may aid in reconnaissance activities.
Mitigation Recommendations
A patch is available and should be applied by upgrading to GitLab versions 18.11.7, 19.0.4, 19.1.2 or later. No additional mitigation is required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-gitlab-2026-7492
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-7492"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6a54ae0068715ace438f7e87
Added to database: 07/13/2026, 09:21:04 UTC
Last enriched: 09/10/2026, 23:02:09 UTC
Last updated: 10/07/2026, 18:48:23 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.