CVE-2026-15387

Published: Aug 26, 2026Modified: Aug 31, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 19.1.0 to 19.1.7
Gitlab Gitlab	From 19.2.0 to 19.2.5
Gitlab Gitlab	Version 19.3.0

Related CWEs

Acceptance of Extraneous Untrusted Data With Trusted Data

The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/605632

Source: cve@gitlab.com

Issue TrackingVendor Advisory

https://hackerone.com/reports/3754358

Source: cve@gitlab.com

Permissions RequiredThird Party Advisory

Timeline

No history available yet.