Ad · Leaderboard 728×90

CVE-2026-82632

3.1Low

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

3.1Low
Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None
Impact
Limited impact
Weakness
CWE-863

Impact

Authenticated users with fine-grained personal access tokens can import projects into unauthorized group namespaces. An attacker needs a valid user account and a token granted user-scoped import privileges.

Root cause

GitLab improperly authorizes the target namespace during project imports when evaluating fine-grained Personal Access Token permissions.

Affected systems

GitLab CE/EE versions 18.9 through 19.2.7, 19.3.0 through 19.3.4, and 19.4.0 through 19.4.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade GitLab CE/EE to 19.2.8, 19.3.5, 19.4.2, or later. No workaround is provided; prioritize updating the package.

shell
$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-ee

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token's intended scope, due to incorrect authorization of the import target namespace.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-82632

Ad · Sticky 320×50 / 728×90