CVE-2026-1322: Authorization Bypass in GitLab

The primary impact of CVE-2026-1322 is the potential for unauthorized access and modification of private project data within GitLab. An attacker leveraging a readapi OAuth application could create issues, add comments, and potentially manipulate project workflows without proper authorization. This could lead to data breaches, intellectual property theft, or disruption of development processes. While the vulnerability requires an existing OAuth application, the ease of creating such applications lowers the barrier to exploitation. The scope of impact is limited to projects where the attacker has access to a readapi OAuth application, but the potential for widespread impact across an organization's GitLab instance remains significant.

1. Réservé2026-01-22
2. Publiée2026-05-14

The recommended mitigation for CVE-2026-1322 is to immediately upgrade GitLab to version 18.11.3 or later. If upgrading is not immediately feasible, consider reviewing and restricting the permissions granted to OAuth applications, specifically limiting the scope of the readapi permission. Implement stricter access controls within GitLab to limit the ability of users to create issues and add comments to private projects. Monitor GitLab audit logs for suspicious activity related to issue creation and comment modification, particularly from OAuth applications. After upgrading, confirm the fix by attempting to create an issue in a private project using a readapi OAuth application; the action should be denied.