CVE-2026-9268: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which users could exploit this issue?
An attacker would need to be an authenticated GitLab EE user who already has limited permissions. The issue could allow that user to modify project CI/CD deployment rollback settings without the authorization normally required.
Which GitLab EE versions need remediation?
Affected versions are 13.6 through versions before 19.2.8, 19.3 through versions before 19.3.5, and 19.4 through versions before 19.4.2. Upgrade to 19.2.8, 19.3.5, 19.4.2, or a later release in the applicable release line.
What should teams do while an upgrade is pending?
Limit access for low-privilege authenticated users to projects where unauthorized changes to CI/CD deployment rollback settings would be consequential. Review and restrict project membership and permissions, particularly for users who do not need deployment-related access.
How can administrators check for potential impact?
Review project CI/CD deployment rollback settings for unexpected modifications and correlate changes with authenticated users holding limited project permissions. The provided information does not identify a specific audit event or indicator unique to this issue.