CVE-2026-16794: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which deployments are affected?
GitLab EE is affected in versions 18.11 through before 19.1.8, 19.2 through before 19.2.6, and 19.3 through before 19.3.2. The issue applies to group projects under certain conditions involving compliance framework management.
What access does an attacker need?
An attacker must be an authenticated user assigned the Security Manager role. No user interaction is required.
What could exploitation allow?
A Security Manager could execute arbitrary CI/CD jobs and access protected variables in affected group projects. The reported impact is integrity-related; confidentiality and availability impacts are listed as none.
Which fixed versions should be used?
Upgrade to GitLab EE 19.1.8, 19.2.6, 19.3.2, or a later applicable release.