CVE-2026-104661: Incorrect Privilege Assignment in GitLab
Published Oct 13, 2026
·Updated
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.
Affected Software
1 affected component
GitLab GitLab EE>=17.0<19.2.8, >=19.3<19.3.5, >=19.4<19.4.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Oct 13, 2026
CVE Published
via MITRE·01:05 AM
Data Sourced
via MITRE·01:05 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness