CVE-2026-16627 is a high severity (CVSS 7.7) cross-site scripting flaw in GitLab CE and EE. Versions from 19.2 before 19.2.2 do not sanitize HTML in a CI job modal, which lets a developer role user escalate privileges. GitLab fixed it in 19.2.2 on 12 August 2026.
What's affected
GitLab CE and EE, all versions from 19.2 before 19.2.2. The fix shipped in the patch release 19.2.2, released on 12 August 2026 together with 19.1.4 and 19.0.6, which carry other security fixes. Per GitLab's notice, GitLab.com already runs the patched version and GitLab Dedicated customers do not need to act. Self-managed installations do.
This CVE is listed against 19.2 only, so 19.1 and 19.0 are not affected by this one. Move to the latest patch of your line anyway, because the same release fixes other issues.
How to check if you're exposed
Find your version. As an administrator, the version shows on the Help page, or at the bottom of the Admin Area. On an Omnibus or source install you can run the environment report.
sudo gitlab-rake gitlab:env:info
If the version is 19.2.0 or 19.2.1, you are affected. If you run 19.1 or 19.0, upgrade to the patch levels in GitLab's notice for the other fixes.
Then think about who holds the developer role. The flaw needs an authenticated user with at least that role, and it needs a victim to interact with the page.
What to do now
- Check the GitLab version on every self-managed instance, including test and runner hosts that serve the UI.
- Upgrade 19.2 instances to 19.2.2 or later.
- Upgrade 19.1 and 19.0 to 19.1.4 and 19.0.6 or later for the other advisories in the same release.
- Review recent developer role grants and remove those that are not needed.
- Review changes to CI manual job settings made while you were unpatched.
Why it matters
The weakness is CWE-79 (Cross-site Scripting). A CI job confirmation modal rendered HTML that came from user controlled content without cleaning it first, so a developer could plant markup that runs in the browser of another user who opens the modal. If that user has higher privileges, the script acts with them, which is how a low role becomes a high one.
The vector marks scope as changed and user interaction as required, and attack complexity as high. CISA does not list this CVE as known exploited, and GitLab's notice does not say it has been seen in the wild.
Try it yourself
See how a patch release like this one moves through discovery, triage and fix tracking.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to act on GitLab.com?
No. GitLab says GitLab.com already runs the patched version.
Sources
Last reviewed: 19 October 2026.
