CVE-2026-16301

GitLab fixed an improper authorization flaw (CWE-863) in GitLab Community Edition and Enterprise Edition. Under certain conditions, an authenticated user who already has the Developer role could use the downstream pipeline creation service without the required authorization checks. That allowed the user to run CI/CD pipelines on protected branches they were not permitted to use, with high integrity impact and limited confidentiality impact (CVSS 8.5). Affected releases are all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. No public proof-of-concept is known, and the issue is not in the CISA Known Exploited Vulnerabilities catalog.

What to do: Upgrade GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or a later release on the same line). Until then, review downstream CI/CD pipeline runs on protected branches started by Developer-role users and limit who can create downstream pipelines where those branches are sensitive.