12 September 2026
Reference: CVE-2026-85706
1. What is being reported?
GitLab has fixed a problem affecting certain versions of its software where unauthenticated users could access files on the server through a weakness in the repository commits feature. This happened because the software did not properly restrict file access or require login checks in some cases.
2. What this means in plain English
If your organisation uses GitLab versions affected by this flaw, attackers could potentially view sensitive files stored on your GitLab server without needing a password. This could lead to data leaks or other security issues.
3. Could this affect a small business?
Small businesses or organisations using the affected GitLab versions could be at risk, especially if their GitLab server is accessible from the internet. Those not using GitLab or using updated versions are unlikely to be affected.
4. What to do now
- Check if your GitLab installation is one of the affected versions listed by GitLab.
- Apply the latest security updates or patches provided by GitLab immediately.
- If you use cloud services with GitLab, ensure they follow the latest security guidance or consider discontinuing use if patches are not available.
- Consult your IT provider to confirm your GitLab server is not exposed to the internet or is properly secured.
5. Ask your IT provider
Can you confirm if our GitLab installation is affected by CVE-2026-85706 and has been updated to the fixed version to prevent unauthenticated file access?
6. Bottom line
If you use GitLab, update it now to stop attackers from accessing your files without permission.
Information based on CISA KEV, NVD and multiple reputable security reports.