CVE-2026-16275

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-162762.7The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store reCVE-2026-162776.5A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address infoCVE-2026-162799.3An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026CVE-2026-16284.6Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which aCVE-2026-162809.8An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs largeCVE-2026-162817.1The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI imagCVE-2026-162825.3The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side confiCVE-2026-162857.5The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media libraryCVE-2026-162869.8Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade CVE-2026-162877.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software TechnoloCVE-2026-162894.3The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, aCVE-2026-16294.3Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the u
CVE-2026-16275: Medium severity, CVSS 5.3 | Vulnix