What is the CVSS score of CVE-2026-0934?

CVE-2026-0934 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-0934?

Yes, a patch is available for CVE-2026-0934. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-0934

EUVD-2026-39179 LOW

Incorrect Authorization (CWE-863)

2026-06-25 cve@gitlab.com

GHSA-394r-q6wg-v263

Authentication Bypass Gitlab

3.8

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

3.8 LOW

PR:H reflects that exploitation requires an administrator-assigned custom role; C:L/I:L captures config read and write access with no availability or scope impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:31 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configurations despite CI/CD visibility being disabled for the project.

AnalysisAI

Protected environment configuration bypass in GitLab Enterprise Edition exposes CI/CD deployment gates to authenticated users holding custom role permissions, even when CI/CD visibility is explicitly disabled for the project. Affecting all EE versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1, this CWE-863 (Incorrect Authorization) flaw allows such users to view, create, or delete protected environment rules that should be inaccessible. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

GitLab EE's custom roles feature allows administrators to define granular permission sets beyond standard member tiers (Guest, Reporter, Developer, Maintainer, Owner). Protected environments are a CI/CD security boundary that restrict which users or groups may deploy to specific environments such as production. CWE-863 (Incorrect Authorization) indicates that the authorization logic correctly identifies the user's role but fails to enforce the additional project-level restriction that CI/CD visibility is disabled - the permission check evaluates role capabilities without cross-checking the visibility gate. The vulnerability lives at the intersection of two subsystems: custom role permission evaluation and the project-level CI/CD visibility toggle, where their combined enforcement is incomplete. Referenced in GitLab work item 585961 and disclosed via HackerOne report 3508760.

RemediationAI

Upgrade GitLab EE to version 18.11.6 (for the 18.x line), 19.0.3 (for the 19.0 line), or 19.1.1 (for the 19.1 line) or later, as documented in the GitLab patch release at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. If immediate upgrade is not operationally feasible, a targeted compensating control is to audit and revoke custom role assignments for any users who should not have access to protected environment configurations - since exploitation is gated on holding a custom role, limiting custom role membership directly constrains the exposed population. A secondary interim measure is temporarily re-enabling CI/CD visibility on sensitive projects (removing the configuration that triggers the flaw), though this trades one security control for another and may expose CI/CD pipeline details to broader project members. Neither workaround substitutes for patching.