ZeroHour

CVE-2026-16794

large

Missing Authorization in GitLab EE Exposes CI/CD Jobs and Protected Variables

CVSS 3.1
4.3 medium
EPSS
Published
()
Modified
AI analysis

GitLab EE contains a missing-authorization flaw (CWE-862) in its compliance framework management controls. Under certain conditions, an authenticated user who has been granted the Security Manager role could bypass intended authorization checks and execute arbitrary CI/CD jobs in group projects and access protected CI/CD variables. Exploitation requires only network access and a valid authenticated account holding the Security Manager role, with no user interaction, per the CVSS vector. All GitLab Enterprise Edition versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected; only EE is named in the advisory. There is no known public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Upgrade GitLab EE to 19.3.2, 19.2.6, or 19.1.8 (or later) depending on your version train, including deployments on the 18.11-19.1 releases. Until patched, audit which users hold the Security Manager custom role in each group and review recent CI/CD job runs and protected-variable access on group projects linked to compliance frameworks for signs of misuse.

Affected
GitLab Enterprise Edition (EE)all versions from 18.11 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 (fixed in 19.1.8, 19.2.6, and 19.3.2)
Estimated exposure
largetens of thousands of self-managed GitLab EE instances — Internet-wide scans (e.g., Shodan) have historically indexed on the order of 50,000+ self-managed GitLab servers (CE and EE combined), and EE is common among organizational/paid deployments, so the EE-affected subset is plausibly in the…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.

Weakness
CWE-862
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In the news

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.