Self-managed GitLab flaw reportedly allows file reads without a login

DailyCVEBrief describes CVE-2026-85706 as an unauthenticated arbitrary file-read flaw affecting only self-managed GitLab CE/EE, with a CVSS severity score of 10.0. It reports a September 10, 2026 patch, a Known Exploited Vulnerabilities listing on September 11 and probing that same day. The account says there is no workaround and urges users to rotate secrets because patching cannot undo any file reads that already occurred.