CVE-2026-104661
4.3MediumPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-266
Impact
Authenticated users with custom compliance administration roles can configure and trigger unintended compliance pipelines across group projects. They need an active account with these specific custom permissions first.
Root cause
Improper privilege assignment allows custom compliance roles to inject and execute pipelines broader than intended.
Affected systems
GitLab EE 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade GitLab EE to 19.2.8, 19.3.5, or 19.4.2 or later. If patching immediately is not possible, temporarily remove compliance framework administration permissions from all custom roles.
$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-eeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/621386Issue Tracking