CVE-2026-16794

MEDIUMCVSS 4.3

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.

Timeline

Published:September 16th, 2026 7:16 AM

Last modified:September 28th, 2026 3:21 PM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Software

From NVD CPE configuration data

Vendors

gitlab

Products

gitlab

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/Release Notes
https://gitlab.com/gitlab-org/gitlab/-/work_items/606750Broken Link
https://hackerone.com/reports/3785754Permissions Required

Source: NIST NVD · Data may lag official sources by up to one minute