GitLab: incorrect authorisation

At a glance

GitLab: Amber, patch this week. GitLab CE/EE has a vulnerability in all versions from 7.0 before 18.11.13, allowing an unauthenticated user to execute arbitrary code on the server due to an integer overflow when compiling a specially crafted regular expression.

The flaws

• CVE-2026-16255: Incorrect authorisation (CVSS 7.1 · EPSS 0%)
• CVE-2026-110264: Integer overflow can lead to remote code execution (CVSS 10.0 · EPSS 1%)
• CVE-2026-93577: Integer overflow can lead to remote code execution (CVSS 9.9 · EPSS 1%)
• CVE-2026-89078: Double free can lead to remote code execution (CVSS 9.9 · EPSS 0%)

The fix

Upgrade GitLab: 19.3.6 · 19.4 · 19.4.3 · 19.5 · 19.5.1 · 18.11.13 or later on your release line

Who is exposed: {'products': ['GitLab CE', 'GitLab EE'], 'packages': [], 'versions': ['7.0 before 18.11.13', '19.0 before 19.0.10', '19.1 before 19.1.9', '19.2 before 19.2.9', '19.3 before 19.3.6', '19.4 before 19.4.3', '19.5 before 19.5.1']}

Where it stands

• Exploitation reported in the press
• 1 outlet covering it

How it unfolded

1. 22 Oct, BleepingComputer (press): GitLab warns of new max severity code execution vulnerability
2. 30 Oct, BleepingComputer (press): CISA says max severity GitLab flaw now exploited in the wild

Connects to

• Same weakness: Incorrect authorisation (CWE-863). 376 other warnings in 30 days
• Same product: Earlier GitLab warnings. 42 in the last 90 days
• Reported alongside: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. CVE-2026-97229 · in 2 of the same articles