CVE-2026-7514

CVE-2026-7514 is a missing-authorization flaw (CWE-862) in the Generic Package Registry of GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all releases from 13.9 up to the fixed versions 19.1.8, 19.2.6, and 19.3.2. An authenticated user holding the developer role in a project can trigger it remotely over the network, with no user interaction, by submitting or manipulating files through the Generic Package Registry. The attacker gains integrity-level impact: they can substitute the file content of packages and hide packages from their legitimate owners, though the CVSS score indicates no data disclosure or availability loss. Any GitLab CE/EE deployment in the affected ranges is exposed where projects use the Generic Package Registry and have developer-role collaborators. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; the separately reported critical GitLab flaws (arbitrary file read, credential theft, code execution) are distinct issues.

What to do: Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (or later). Until patched, review project membership for developer-role users on projects publishing Generic Packages, and audit registries for unexpected content changes or packages hidden from their owners. Consider disabling the generic packages feature for projects that do not need it, and note that the separately reported critical GitLab flaws warrant urgent patching as well.