CVE-2026-18433 is an authorization bypass vulnerability in GitLab EE affecting versions >=19.1.0 <19.1.4 and >=19.2.0 <19.2.2. The vulnerability arises from incorrect authorization checks in a GraphQL query, which under certain conditions permits an authenticated user to access policy configuration data of unauthorized namespaces. This could lead to unauthorized disclosure of sensitive configuration information. The vendor has released patches in versions 19.1.4 and 19.2.2 to address this issue.

An authenticated user could read policy configuration data from namespaces they should not have access to. This unauthorized disclosure could potentially reveal sensitive configuration details, impacting confidentiality. There is no indication of privilege escalation or remote code execution. No known active exploitation has been reported.

A patch is available and has been released in GitLab EE versions 19.1.4 and 19.2.2. Users should upgrade affected installations to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor.