CVE-2026-16275

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-25)

CWE

CWE-863

Published

2026-10-13

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• gitlab:gitlab

References

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
• https://gitlab.com/gitlab-org/gitlab/-/work_items/606490
• https://hackerone.com/reports/3815259

Check your stackJSON