CVE-2026-104661: Incorrect Privilege Assignment in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which users could exploit this issue?
An attacker would need to be authenticated and hold a custom role that includes compliance framework administration permissions. The issue affects the ability of that role to configure and execute a specially crafted compliance pipeline across group projects.
Which GitLab EE versions need remediation?
Affected versions are all GitLab EE releases from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Upgrading to 19.2.8, 19.3.5, 19.4.2, or a later release remediates the issue.
What impact could successful exploitation have?
Successful exploitation could allow improper configuration and execution of a specially crafted compliance pipeline across projects in a group. The supplied severity data indicates integrity impact, with no stated confidentiality or availability impact.