Description
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| GitLab | GitLab | unaffected |
|
No data.
No data.
No data available yet.
Remediation
Vendor Solution
Upgrade to versions 19.2.8, 19.3.5, 19.4.2 or above.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Tue, 13 Oct 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment. | |
| Title | Incorrect Privilege Assignment in GitLab | |
| First Time appeared |
Gitlab
Gitlab gitlab |
|
| Weaknesses | CWE-266 | |
| CPEs | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Gitlab
Gitlab gitlab |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitLab
Published:
Updated: 2026-10-13T01:05:06.282Z
Reserved: 2026-10-02T07:39:09.123Z
Link: CVE-2026-104661
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-266
Incorrect Privilege Assignment