CVE-2026-81839
7.7HighPublished 13 Oct 2026 · NVD status: Analyzed
7.7High
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-863
The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Ad · In-content banner
NVD description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/624150Issue Tracking
- https://hackerone.com/reports/3925062Permissions Required