CVE-2026-12664: 
GitLab vulnerability analysis and mitigation

CVE-2026-12664 is an Incorrect Authorization vulnerability in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Under certain conditions, an authenticated user holding a read_api-scoped personal access token could retrieve a project's incoming email address and create work items, effectively bypassing the token's intended scope restrictions due to insufficient enforcement on a GraphQL field. The vulnerability was published on October 22, 2026, and carries a CVSS v3.1 base score of 6.8 (Medium) (ENISA EUVD, GitLab Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the GitLab GraphQL API fails to properly enforce token scope restrictions on a specific field that exposes a project's incoming email address. A read_api-scoped token is intended to provide read-only API access, but insufficient scope checking on the relevant GraphQL field allows the token to also perform write operations — specifically, creating work items via the project's incoming email address. Exploitation requires the attacker to be authenticated (low privilege) and to meet certain unspecified conditions, contributing to the High attack complexity rating (ENISA EUVD, HackerOne Report).

Successful exploitation allows an attacker with a read_api-scoped token to both disclose a project's incoming email address (confidentiality impact) and create unauthorized work items within the project (integrity impact). This bypasses the principle of least privilege enforced by token scoping, potentially enabling spam, issue manipulation, or information gathering about internal project communication channels. Availability is not impacted, and the scope remains unchanged, limiting blast radius to the affected project (ENISA EUVD).

As of the publication date, no public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation (Feedly Intelligence). The EPSS score is reported at 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was originally reported via HackerOne (HackerOne Report).

1. Obtain a read_api-scoped token: The attacker must be an authenticated GitLab user with a personal access token scoped to read_api for a target project.
2. Identify the vulnerable GraphQL field: Query the GitLab GraphQL API using the read_api token to access the project's incoming email address field, which should normally be restricted to tokens with broader write scopes.
3. Retrieve the incoming email address: Due to insufficient scope enforcement, the GraphQL query succeeds and returns the project's incoming email address.
4. Create unauthorized work items: Use the retrieved incoming email address to send emails that create work items (e.g., issues) in the target project, bypassing the read_api token's intended read-only restrictions (HackerOne Report, ENISA EUVD).

• Logs: GitLab API access logs showing read_api-scoped token requests to GraphQL endpoints querying incoming email address fields; unexpected work item creation events attributed to read_api-scoped tokens in project audit logs.
• Network: Unusual GraphQL POST requests to /api/graphql from authenticated sessions using read_api tokens that include queries for project incoming email fields.
• Application: New work items (issues) appearing in projects without corresponding user interface activity or broader-scoped token usage, particularly if created via email ingestion.

GitLab has released patched versions addressing this vulnerability: 19.3.6, 19.4.3, and 19.5.1. All GitLab CE/EE administrators running versions from 18.2 onward should upgrade to one of these fixed releases immediately. No specific configuration-based workaround has been published; upgrading is the recommended remediation (GitLab Patch Release).

The vulnerability received coverage from security news outlets including SecurityOnline and CyberSecurityNews shortly after disclosure (SecurityOnline, CyberSecurityNews). Tenable published detection plugins for the vulnerability (Tenable). Community discussion was noted on Infosec.Exchange, though no significant controversy or notable researcher commentary beyond standard patch advisories has been identified.