Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.8
CVE-2026-0934: GitLab EE: Authenticated Users Can Access Protected Configurations
CVE-2026-0934 · published 4 months ago
Summary
Certain users with custom permissions in GitLab EE can view, create, or delete protected environment settings even when the project's CI/CD visibility is turned off. This issue has been fixed in newer versions of the software. Update to the latest version of GitLab EE to ensure you have the patch.
What to do
- Update gitlab to version 19.1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | gitlab |
>= 19.1.0, < 19.1.1 Fix: upgrade to 19.1.1
|
| – | gitlab | gitlab |
>= 17.9.0, < 18.11.6 >= 19.0.0, < 19.0.3 19.1.0 cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
Original advisory text
Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configurations despite CI/CD visibility being disabled for the project.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-0934 Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/585961 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0934.j... Vendor Advisory
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/ URL
- https://hackerone.com/reports/3508760 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-863Incorrect Authorization
Timeline
Published25 Jun 2026
Updated31 Oct 2026
First seen25 Jun 2026
Track software like this
Free during beta