Missing Authorization in GitLab (CVE-2026-16494)
A missing authorization vulnerability in GitLab Enterprise Edition versions 19.1.0 through before 19.1.4 and 19.2.0 through before 19.2.2 could allow an authenticated user to modify project settings that should be restricted to higher-privileged roles. This issue arises from missing authorization checks on a project update endpoint. The vulnerability has been remediated in versions 19.1.4 and 19.2.2.
AI Analysis
Technical Summary
GitLab EE contained a missing authorization vulnerability (CVE-2026-16494) affecting versions >=19.1.0 <19.1.4 and >=19.2.0 <19.2.2. Under certain conditions, an authenticated user could bypass intended privilege restrictions and modify project settings normally limited to higher-privileged roles. The root cause was missing authorization checks on the project update API endpoint. This vulnerability has been fixed by GitLab in versions 19.1.4 and 19.2.2.
Potential Impact
An authenticated user with lower privileges could escalate their ability to modify project settings that should be restricted, potentially impacting project configuration and security controls. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and users should upgrade to GitLab EE versions 19.1.4 or later and 19.2.2 or later to remediate this vulnerability. Applying these official fixes will restore proper authorization checks on the project update endpoint.
Missing Authorization in GitLab (CVE-2026-16494)
Description
A missing authorization vulnerability in GitLab Enterprise Edition versions 19.1.0 through before 19.1.4 and 19.2.0 through before 19.2.2 could allow an authenticated user to modify project settings that should be restricted to higher-privileged roles. This issue arises from missing authorization checks on a project update endpoint. The vulnerability has been remediated in versions 19.1.4 and 19.2.2.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
GitLab EE contained a missing authorization vulnerability (CVE-2026-16494) affecting versions >=19.1.0 <19.1.4 and >=19.2.0 <19.2.2. Under certain conditions, an authenticated user could bypass intended privilege restrictions and modify project settings normally limited to higher-privileged roles. The root cause was missing authorization checks on the project update API endpoint. This vulnerability has been fixed by GitLab in versions 19.1.4 and 19.2.2.
Potential Impact
An authenticated user with lower privileges could escalate their ability to modify project settings that should be restricted, potentially impacting project configuration and security controls. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and users should upgrade to GitLab EE versions 19.1.4 or later and 19.2.2 or later to remediate this vulnerability. Applying these official fixes will restore proper authorization checks on the project update endpoint.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-gitlab-2026-16494
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-16494"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a8460a2c6e8be033245a860
Added to database: 08/18/2026, 13:39:46 UTC
Last enriched: 08/18/2026, 13:42:24 UTC
Last updated: 08/18/2026, 13:42:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.