Low severity3.3NVD Advisory· Published Aug 12, 2026

CVE-2025-9486

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GitLab Inc./gitlab-org/gitlab-eellm-fuzzy
Range: from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
GitLab Inc./GitLabllm-fuzzy
Range: from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2

Patches

Vulnerability mechanics

References

docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/nvd
gitlab.com/gitlab-org/gitlab/-/issues/565412nvd
hackerone.com/reports/3262844nvd

News mentions

GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6
GitLab Security Releases · Aug 12, 2026

cvss	0.214
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000