What is the CVSS score of CVE-2026-14341?

CVE-2026-14341 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-14341?

Yes, a public proof-of-concept exploit is available for CVE-2026-14341. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-14341?

Yes, a patch is available for CVE-2026-14341. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-14341

EUVD-2026-50480 MEDIUM

Missing Authorization (CWE-862)

2026-07-29 GitLab

GHSA-35pc-qwv6-4858

Authentication Bypass Gitlab

4.9

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

4.9 MEDIUM

Network API access, no complexity or interaction required, but Maintainer role mandatory (PR:H); only protected branch integrity is impacted, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 20:03 vuln.today

Patch available

Jul 29, 2026 - 20:02 EUVD

CVE Published

Jul 29, 2026 - 19:00 cve.org

MEDIUM 4.9

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint.

AnalysisAI

Improper authorization in a GitLab CE/EE projects API endpoint allows an authenticated user holding the Maintainer role to modify protected branch configurations beyond what their role should permit, across all versions from 12.8 through 19.2.0. Maintainer-role users - commonly assigned in enterprise GitLab deployments - can exploit this to weaken or remove branch protection rules that enforce code review gates and direct-push restrictions. A publicly available exploit exists via HackerOne report 3807593; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the POC materially lowers the bar for exploitation.

Technical ContextAI

GitLab CE/EE exposes a REST-based projects API used for repository and branch management. CWE-862 (Missing Authorization) identifies the root cause: a specific API endpoint within the projects API fails to enforce the boundary between the Maintainer and Owner/Administrator roles when processing requests to alter protected branch settings. In GitLab's permission model, protected branches are a security control intended to prevent direct pushes, enforce merge request approvals, and restrict who can merge - configuration of these is deliberately gated above the Maintainer level. The affected CPE is cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* spanning a wide version range starting at 12.8, indicating the authorization gap persisted across multiple major release trains. The flaw was internally tracked as GitLab work item 604665 and publicly disclosed via HackerOne report 3807593.

RemediationAI

Upgrade to one of the three patched releases: GitLab 19.0.5, 19.1.3, or 19.2.1, as confirmed by the GitLab patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/. Organizations unable to upgrade immediately should audit current Maintainer-role assignments across projects, removing any users whose Maintainer grant is broader than strictly required - this reduces the exploitable population without changing product behavior. Additionally, GitLab administrators can temporarily enforce stricter controls by requiring Owner-level approval for all protected branch configuration changes via group-level access controls, though this may introduce workflow friction for legitimate Maintainer operations. Self-managed GitLab instances should prioritize patching over workarounds given the public POC availability.