CVE-2026-4398: Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.1
Event History
Frequently Asked Questions
Which GitLab deployments are affected?
The issue affects self-managed GitLab EE instances. The description does not identify GitLab.com or other deployment types as affected.
What access does an attacker need?
An attacker must be an authenticated user and must be able to act on their own project. Exploitation involves assigning a compliance framework from a namespace the user is not authorized to access.
Which versions need remediation?
Affected versions are GitLab EE 18.3 through versions before 19.1.7, 19.2 through versions before 19.2.5, and 19.3 through versions before 19.3.1. Updating to 19.1.7, 19.2.5, or 19.3.1, as applicable, remediates the issue.
How can administrators assess potential exposure?
Review whether authenticated users assigned compliance frameworks from namespaces where they lacked authorization to projects they controlled. The provided information does not specify a log event, audit record, or detection method for confirming exploitation.