CVE-2026-12664 GitLab CVE debrief

Who should care

GitLab administrators and security teams should assess exposure and prioritize remediation, especially in deployments using affected versions. They should verify affected versions in their inventory and prioritize updates to fixed versions 19.3.6, 19.4.3, or 19.5.1. Security teams should also review and restrict read_api-scoped tokens to necessary users, and consider compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-12664 because it affects GitLab deployments, potentially allowing unauthorized information disclosure and work item creation. GitLab administrators and security teams should verify exposure, especially in versions 18.2 to 19.5.0, and prioritize updates to fixed versions 19.3.6, 19.4.3, or 19.5.1. Evidence is based on official CVE and NVD records.

• Potential unauthorized project information disclosure.
• Possible creation of unauthorized work items.
• Need for verification of affected versions in inventory.
• Priority on updating to remediated versions.

Technical summary

The vulnerability affects GitLab CE/EE versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. An authenticated user with a read_api-scoped token could potentially retrieve a project's incoming email address and create work items due to insufficient scope enforcement on a GraphQL field. This issue has been remediated by GitLab, and defenders should prioritize verifying exposure in their GitLab deployments, especially those using affected versions, and ensure remediation by updating to fixed versions.

Defensive priority

Defenders should prioritize verifying exposure in their GitLab deployments, especially those using affected versions, and ensure remediation by updating to fixed versions.

Recommended defensive actions

• Verify GitLab deployment versions and compare to affected ranges.
• Update to remediated versions 19.3.6, 19.4.3, or 19.5.1 as applicable.
• Review and restrict read_api-scoped tokens to necessary users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and remediation information. Evidence is based on official CVE and NVD records, with limitations on the scope of verification and potential impact assessment. Defenders should verify affected versions in their inventory and prioritize updates to fixed versions 19.3.6, 19.4.3, or 19.5.1. The vendor has remediated the issue, but specific details on the vulnerability's exploitation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.