CVE-2026-103549: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab instances are affected?
GitLab CE/EE is affected in versions from 17.6 up to, but not including, 19.2.8; versions before 19.3.5 in the 19.3 release line; and versions before 19.4.2 in the 19.4 release line.
What access does an attacker need?
An attacker must already be authenticated and have maintainer-role permissions. Exploitation also depends on conditions where package protection rules would normally reserve removal of the affected package registry metadata for higher roles.
What is the impact of exploitation?
A maintainer could remove certain package registry metadata despite package protection rules that restrict that action to higher-privileged roles. The provided severity vector indicates integrity impact only, with no confidentiality or availability impact.
How can this be remediated?
Upgrade to GitLab 19.2.8, 19.3.5, or 19.4.2, as appropriate for the release line in use.