Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.1
CVE-2026-82632: GitLab could let token import projects to wrong groups
CVE-2026-82632 · published 6 days ago
Summary
GitLab versions before the recent patches let a user who has a personal access token limited to importing their own projects accidentally import a project into a group they don’t belong to. This could let someone place code where they shouldn’t have access. Updating GitLab to the latest release fixes the permission check.
What to do
- Update gitlab to version 19.4.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | gitlab | gitlab |
< 19.2.8 >= 18.9.0, < 19.2.8 >= 19.3.0, < 19.3.5 >= 19.4.0, < 19.4.2 |
| Bitnami | – | gitlab |
>= 19.4.0, < 19.4.2 Fix: upgrade to 19.4.2
|
Original advisory text
Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token's intended scope, due to incorrect authorization of the import target namespace.
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/626041 Issue Tracking
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ Release Notes Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-82632 URL
- https://hackerone.com/reports/3843143 Permissions Required
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-863Incorrect Authorization
Timeline
Published13 Oct 2026
Updated18 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta