Volerion logoVolerion
Volerion logoVolerion

GitLab CE/EE Missing Authorization Vulnerability in GLQL API

Vulnerability

A missing authorization vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.6 prior to 18.6.6, 18.7 prior to 18.7.4, and 18.8 prior to 18.8.4. This vulnerability could have allowed an authenticated user to perform unauthorized operations by sending GraphQL mutations through the GLQL API endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized operations being performed on behalf of the user.

Remediation

Users are advised to upgrade to GitLab versions 18.8.4, 18.7.4, or 18.6.6.

Added: Feb 11, 2026, 12:30 PM
Updated: Feb 11, 2026, 4:32 PM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
5.0
exploitability
5.2
remediation
7.7
relevance
3.0
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.