CVE-2026-4398

Published: Apr 8, 2026Modified: Sep 28, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	18.3.0 ≤ version < 19.1.7
Gitlab Gitlab	19.2.0 ≤ version < 19.2.5
Gitlab Gitlab	Version 19.3.0

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/600360

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/3549150

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.