CVE-2026-4398: Authorization Bypass Through User-Controlled Key in GitLab

Q: Which GitLab deployments are affected?

The issue affects self-managed GitLab EE instances. The description does not identify GitLab.com or other deployment types as affected.

Q: What access does an attacker need?

An attacker must be an authenticated user and must be able to act on their own project. Exploitation involves assigning a compliance framework from a namespace the user is not authorized to access.

Q: Which versions need remediation?

Affected versions are GitLab EE 18.3 through versions before 19.1.7, 19.2 through versions before 19.2.5, and 19.3 through versions before 19.3.1. Updating to 19.1.7, 19.2.5, or 19.3.1, as applicable, remediates the issue.

Q: How can administrators assess potential exposure?

Review whether authenticated users assigned compliance frameworks from namespaces where they lacked authorization to projects they controlled. The provided information does not specify a log event, audit record, or detection method for confirming exploitation.

Published Apr 8, 2026

Updated

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

Affected Software

1 affected component

GitLab GitLab EE>=18.3, >18.3<19.1.7, >19.1.7<19.2.5, >19.2.5<19.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.1.7
Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.2.5
Upgrade
Upgrade GitLab EE to a version that resolves this vulnerability.
Fixed in 19.3.1

Event History

Apr 8, 2026

CVE Published

via NVD·11:16 PM

Data Sourced

via NVD·11:16 PM

DescriptionSeverityWeakness

Aug 27, 2026

CVE Published

via MITRE·05:53 PM

Data Sourced

via MITRE·05:53 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which GitLab deployments are affected?

The issue affects self-managed GitLab EE instances. The description does not identify GitLab.com or other deployment types as affected.

What access does an attacker need?

An attacker must be an authenticated user and must be able to act on their own project. Exploitation involves assigning a compliance framework from a namespace the user is not authorized to access.

Which versions need remediation?

Affected versions are GitLab EE 18.3 through versions before 19.1.7, 19.2 through versions before 19.2.5, and 19.3 through versions before 19.3.1. Updating to 19.1.7, 19.2.5, or 19.3.1, as applicable, remediates the issue.

How can administrators assess potential exposure?

Review whether authenticated users assigned compliance frameworks from namespaces where they lacked authorization to projects they controlled. The provided information does not specify a log event, audit record, or detection method for confirming exploitation.

CVE-2026-4398: Authorization Bypass Through User-Controlled Key in GitLab

Affected Software

Remediation

Event History

Frequently Asked Questions

Which GitLab deployments are affected?

What access does an attacker need?

Which versions need remediation?

How can administrators assess potential exposure?

Company

Resources

Contact

Frequently Asked Questions

Which GitLab deployments are affected?

What access does an attacker need?

Which versions need remediation?

How can administrators assess potential exposure?