GitLab CE/EE — Authenticated users can access CI data from unintended reference types via incorrect reference resolution (CVSS 4.3)

CVE-2026-4868 (+ five further CVEs) — GitLab 19.0.1 / 18.11.4 / 18.10.7 patch release: Duo AI identity impersonation, unauthenticated project enumeration

GitLab shipped patch versions 19.0.1, 18.11.4 and 18.10.7 on 2026-05-27 closing six CVEs. The most severe is CVE-2026-4868 (CVSS 8.2, CWE-639) — an improper identity-resolution flaw in the GitLab Duo AI integration that allows an authenticated user to impersonate another user when Duo AI workflows are triggered, with the workflow runners executing under the second user's identity. CVE-2026-6713 (CVSS 5.3) lets an unauthenticated attacker enumerate private projects via an incorrect authorization issue in GitLab's GraphQL WorkItem API. Other CVEs in the batch: CVE-2026-1402 (CVSS 6.5, Wiki DoS via malformed markup), CVE-2026-2601 (CVSS 4.3, deployment-data exposure to Developer-role users), CVE-2026-5296 (CVSS 4.3, Developer-role flow-restriction bypass) and CVE-2026-8716 (CVSS 4.3, CI cross-reference data exposure). NCSC-NL advisory NCSC-2026-0168 rates the batch high; CERT-FR / ANSSI carries CERTFR-2026-AVI-0658 as the FR-CERT corroboration. No exploitation reported.