Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-78335: GitLab tokens could modify unrelated group integrations

CVE-2026-78335 · published 23 days ago

Summary

GitLab versions before the latest patches let a user with a project‑specific personal access token change integration settings for a different group. This could let an authorized user make unwanted changes outside their intended area. Update GitLab to the newest release or apply the provided fixes to restore proper permission checks.

What to do

Update gitlab to version 19.4.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	gitlab	gitlab	< 19.2.8 >= 19.1.0, < 19.2.8 >= 19.3.0, < 19.3.5 >= 19.4.0, < 19.4.2
Bitnami	–	gitlab	>= 19.4.0, < 19.4.2 Fix: upgrade to 19.4.2
Ubuntu:16.04:LTS	canonical	gitlab	All versions

Original advisory text

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78335... Vendor Advisory
https://gitlab.com/gitlab-org/gitlab Product
https://gitlab.com/gitlab-org/gitlab/-/work_items/621535 URL
https://hackerone.com/reports/3893467 Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-78335 Vendor Advisory
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ URL
https://ubuntu.com/security/CVE-2026-78335 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-78335 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.2 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published13 Oct 2026

Updated30 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-78335 · NVD

CVE-2026-78335 · MITRE

BIT-gitlab-2026-78335 · OSV

UBUNTU-CVE-2026-78335 · OSV

CVE-2026-78335 · OSV

Track software like this

Free during beta