Ad · Leaderboard 728×90

CVE-2026-78335

4.2Medium

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

4.2Medium
Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None
Impact
Limited impact
Weakness
CWE-863

Impact

Authenticated attackers with a project-scoped personal access token can modify integrations in groups outside their allowed scope. They need valid credentials to an account that can generate project-scoped fine-grained tokens.

Root cause

Improper authorization checks fail to restrict project-scoped fine-grained personal access tokens from managing out-of-scope group integrations.

Affected systems

GitLab CE/EE versions 19.1 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade GitLab to 19.2.8, 19.3.5, 19.4.2, or later. No workarounds or interim mitigations are provided; prioritize patching.

shell
$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-ee

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-78335

Ad · Sticky 320×50 / 728×90