CVE-2026-9268

4.3Medium

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-863

Impact

Authenticated users with low privileges can modify project CI/CD deployment rollback configurations without proper authorization. Attackers need a valid account on the GitLab EE instance.

Root cause

Insufficient access control checks fail to properly validate user permissions before updating deployment rollback settings.

Affected systems

GitLab EE versions 13.6 through 19.2.7, 19.3.0 through 19.3.4, and 19.4.0 through 19.4.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade to GitLab EE 19.2.8, 19.3.5, 19.4.2, or newer. No workaround is documented, so restrict project membership access until patched.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-ee

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/600934Issue Tracking
https://hackerone.com/reports/3687442Permissions Required

Source: nvd.nist.gov/vuln/detail/CVE-2026-9268