Loading vulnerability…
Missing Authorization in GitLab CE/EE cross-project reference pages
CVE-2026-7492 is a missing-authorization vulnerability in GitLab Community Edition and Enterprise Edition affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. Improper authorization controls on cross-project reference pages, including commit discussion display contexts, can allow an unauthenticated user under certain conditions to determine whether a private project exists. The flaw does not require direct access to the private project itself; instead, it leaks project existence through the way cross-project references are handled and displayed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows information disclosure about the existence of private projects to unauthenticated users. While the issue does not by itself grant access to private project contents, it weakens confidentiality boundaries and can support reconnaissance, target validation, and follow-on attacks by revealing otherwise non-public project presence and related metadata cues.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of unauthenticated access to affected GitLab instances where feasible and restrict external access until upgrades can be applied. Because the issue is caused by improper authorization logic in application handling of cross-project references, definitive mitigation requires upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release: 18.11.7 or later in the 18.11 series, 19.0.4 or later in the 19.0 series, or 19.1.2 or later in the 19.1 series. Self-managed deployments running affected versions should be updated immediately.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.