What is the CVSS score of CVE-2026-1752?

CVE-2026-1752 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-1752?

Yes, a patch is available for CVE-2026-1752. Update the affected software to the latest version immediately.

Gitlab CVE-2026-1752

EUVD-2026-20795 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-08 cve@gitlab.com

GHSA-4gm7-r4jp-2xqg

Authentication Bypass Gitlab

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

18.10.3,18.8.9,18.9.5

EUVD ID Assigned

Apr 08, 2026 - 23:24 euvd

EUVD-2026-20795

Analysis Generated

Apr 08, 2026 - 23:24 vuln.today

CVE Published

Apr 08, 2026 - 23:16 nvd

MEDIUM 4.3

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.

AnalysisAI

GitLab EE versions 11.3 through 18.10.2 allow authenticated developers to modify protected environment settings through improper authorization checks in the API, enabling privilege escalation within project scope. The vulnerability requires valid developer credentials and network access but allows an attacker to alter security-critical environment configurations without appropriate permissions. CVSS 4.3 (low severity) reflects limited scope and integrity-only impact; no public exploit or active exploitation via CISA KEV has been confirmed.

Technical ContextAI

The vulnerability stems from CWE-863 (Incorrect Authorization), a category covering failures to enforce proper access control checks. GitLab's API endpoints for protected environment management did not properly validate that the authenticated user held sufficient role permissions (specifically, the authorization logic failed to restrict modifications to users above developer role). Protected environments in GitLab are security boundaries used to control deployment access; the API failed to replicate frontend role-based access controls (RBAC) on the backend. The affected component is GitLab EE (Enterprise Edition), which implements advanced RBAC features; Community Edition versions are not affected. The improper authorization occurs at the API layer, allowing developers (PR:L in CVSS vector) to perform actions intended only for Maintainer or Owner roles.

RemediationAI

Vendors have released patched versions: upgrade GitLab EE to 18.8.9, 18.9.5, or 18.10.3 (or later). The patch restores proper authorization checks in the protected environment API endpoints, ensuring only Maintainer and Owner roles may modify these settings. Organizations unable to upgrade immediately should audit protected environment modification logs (available in GitLab EE audit logs) to identify any unauthorized changes by developer-role users and revert settings if needed. Implement additional network-level access controls to limit API access to trusted networks. For detailed remediation and verification, consult the official GitLab security advisory at https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/ and the related work item at https://gitlab.com/gitlab-org/gitlab/-/work_items/588413.