Volerion logoVolerion
Volerion logoVolerion

GitLab EE Authorization Bypass Vulnerability in Iterations API

Vulnerability

A vulnerability has been identified in GitLab Enterprise Edition (EE) versions 16.7 prior to 18.6.6, 18.7 prior to 18.7.4, and 18.8 prior to 18.8.4. This vulnerability allows an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint, under certain conditions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private iteration data from descendant groups.

Remediation

Users are advised to upgrade to GitLab versions 18.8.4, 18.7.4, or 18.6.6. Instructions for updating GitLab can be found on the GitLab Update page.

Added: Feb 11, 2026, 12:22 PM
Updated: Feb 11, 2026, 4:29 PM

Vulnerability Rating

Custom Algorithm
spread
7.3
impact
0.6
exploitability
5.2
remediation
7.7
relevance
3.0
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.