CVE-2026-5954

Incorrect Authorization in GitLab

GitLab GitLabApplications & CMS

CVSS

4.2Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in19.2.8Also 19.3.5, 19.4.2CVE List

Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

19.2.8GitLabCVE List
19.3.5GitLabCVE List
19.4.2GitLabCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8GitLab releases, 12 Oct 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.

Text from CVE List

Affected versions 3

GitLabaffected: 15.1 before 19.2.8CVE List
GitLabaffected: 19.3 before 19.3.5CVE List
GitLabaffected: 19.4 before 19.4.2CVE List