GitLab EE Auth Bypass in Token Generation (19.1 < 19.1.3, 19.2 < 19.2.1)
CVE-2026-15831 Published on July 29, 2026
Generation of Incorrect Security Tokens in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation.
Vulnerability Analysis
CVE-2026-15831 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Generation of Incorrect Security Tokens
The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
Products Associated with CVE-2026-15831
Want to know whenever a new CVE is published for GitLab? stack.watch will email you.
Affected Versions
GitLab:- Version 19.1 and below 19.1.3 is affected.
- Version 19.2 and below 19.2.1 is affected.