CVE-2026-14210: Insufficient Granularity of Access Control in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which deployments are affected?
GitLab CE/EE is affected in versions from 18.11 up to, but not including, 19.2.8; 19.3.5; or 19.4.2, depending on the release branch.
What access does an attacker need?
An attacker needs to be authenticated and possess a project-scoped fine-grained Personal Access Token. No user interaction is required.
What could an attacker do?
Under certain conditions, the attacker could permanently delete or modify group-level labels because label ownership scope validation used incorrect authorization logic.
How can the issue be remediated?
Upgrade GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2, as appropriate for the deployed release branch.