Description
This CVE ID has been rejected. GitLab determined that the reported behavior does not constitute a vulnerability: linking a group SAML identity requires the user to explicitly consent to that group controlling their GitLab account for sign-in, and management of group SAML identities by a group Owner is therefore expected behavior rather than an authorization bypass. No GitLab version was affected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gitlab | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-runner-18.11 +5 | 18.11.4-r2 | — |
| Wolfi rolling | gitlab-runner-18.6 +29 | No fix yet | — |
| Wolfi rolling | gitlab-runner-19.0 +5 | 19.0.2-r0 | — |
Advisories 2
- NCSC-2026-0196 Kwetsbaarheden verholpen in GitLab Enterprise Edition NCSC-NL (Netherlands) · Jun 12, 2026
- WID-SEC-2026-1886 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 11, 2026