CVE-2026-103549: Incorrect Authorization in GitLab

Q: Which GitLab instances are affected?

GitLab CE/EE is affected in versions from 17.6 up to, but not including, 19.2.8; versions before 19.3.5 in the 19.3 release line; and versions before 19.4.2 in the 19.4 release line.

Q: What access does an attacker need?

An attacker must already be authenticated and have maintainer-role permissions. Exploitation also depends on conditions where package protection rules would normally reserve removal of the affected package registry metadata for higher roles.

Q: What is the impact of exploitation?

A maintainer could remove certain package registry metadata despite package protection rules that restrict that action to higher-privileged roles. The provided severity vector indicates integrity impact only, with no confidentiality or availability impact.

Q: How can this be remediated?

Upgrade to GitLab 19.2.8, 19.3.5, or 19.4.2, as appropriate for the release line in use.

Published Oct 13, 2026

Updated

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.

Affected Software

1 affected component

GitLab GitLab CE/EE>=17.6<19.2.8, >=19.3<19.3.5, >=19.4<19.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.2.8
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.3.5
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.4.2

Event History

Oct 13, 2026

CVE Published

via MITRE·01:05 AM

Data Sourced

via MITRE·01:05 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which GitLab instances are affected?

GitLab CE/EE is affected in versions from 17.6 up to, but not including, 19.2.8; versions before 19.3.5 in the 19.3 release line; and versions before 19.4.2 in the 19.4 release line.

What access does an attacker need?

An attacker must already be authenticated and have maintainer-role permissions. Exploitation also depends on conditions where package protection rules would normally reserve removal of the affected package registry metadata for higher roles.

What is the impact of exploitation?

A maintainer could remove certain package registry metadata despite package protection rules that restrict that action to higher-privileged roles. The provided severity vector indicates integrity impact only, with no confidentiality or availability impact.

How can this be remediated?

Upgrade to GitLab 19.2.8, 19.3.5, or 19.4.2, as appropriate for the release line in use.

CVE-2026-103549: Incorrect Authorization in GitLab

Affected Software

Remediation

Event History

Frequently Asked Questions

Which GitLab instances are affected?

What access does an attacker need?

What is the impact of exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which GitLab instances are affected?

What access does an attacker need?

What is the impact of exploitation?

How can this be remediated?