GitLabCVE-2026-86341
GitLab: improper access control
Medium4.4CVE-2026-86341 · Published Sep 16, 2026
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production, due to improper access control checks performed after the protected resource was modified.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| GitLab Product | >= 17.1, < 19.1.8 | 19.1.8 |
| >= 19.2, < 19.2.6 | 19.2.6 | |
| >= 19.3, < 19.3.2 | 19.3.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-1280
More GitLab advisories
All GitLab| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 16 | GitLab: cross-site scripting | High8.2 | 19.1.8+2 more |
| Sep 16 | GitLab: improper authorization | High8.5 | 19.1.8+2 more |
| Sep 16 | GitLab: improper authorization | Medium4.3 | 19.1.8+2 more |
| Sep 16 | GitLab: missing authorization | Medium4.3 | 19.1.8+2 more |
| Sep 16 | GitLab: cross-site scripting | Medium4.7 | 19.1.8+2 more |
| Sep 16 | GitLab: denial of service | High7.5 | 19.1.8+2 more |