CVE-2026-86341: Access Control Check Implemented After Asset is Accessed in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production, due to improper access control checks performed after the protected resource was modified.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which GitLab deployments are affected?
GitLab EE versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected. Versions outside those stated ranges are not identified as affected in the provided data.
What level of access does an attacker need?
Exploitation requires an authenticated GitLab user who has Owner or Maintainer permissions. The issue occurs only under certain conditions.
What is the practical impact?
A permitted user could silently disable deployment approval requirements for protected environments. This could allow deployments to reach production without the approvals that would normally be required.
What versions contain the remediation?
The remediation is included in GitLab EE 19.1.8, 19.2.6, and 19.3.2.