Live › vulnerability › CVE-2026-12664
Go to dashboardA GraphQL field in GitLab CE/EE does not enforce token scope, so a user holding a read_api-scoped token can fetch a project's incoming email address and create work items. The flaw is limited to authenticated users under certain conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted GitLab CE or EE instances on the affected version ranges with users who hold read_api-scoped tokens. Instances where all users are trusted, or that run GitLab.com managed hosting, are not the team's to patch.
No product ranges from the sources yet.
gitlab-rake gitlab:env:info or the Version line on the Admin Area page19.3.6, 19.4 before 19.4.3, or 19.5 before 19.5.119.3.6, 19.4.3, 19.5.1 or later within the matching release lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing the token's restrictions, due to insufficient scope enforcement on a GraphQL field.
This page as .md · .json · in your agent: get_signal("CVE-2026-12664")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.