GitLab CVE-2026-78335

Exploitation requires the attacker to hold a valid, authenticated project-scoped fine-grained Personal Access Token in GitLab CE/EE, and to operate against the specific affected versions (19.1-19.2.7, 19.3-19.3.4, 19.4-19.4.1). The flaw only manifests 'under certain conditions' (not fully enumerated in the available data), which aligns with the CVSS AC:H rating and meaningfully limits reliability. The practical limiting factors are: valid token possession (PR:L - no unauthenticated path), the high-complexity conditional trigger, and the bounded impact of modifying integrations for a group outside the token's scope rather than full account or instance takeover. No end-user interaction is required (UI:N).

This is a low-severity (CVSS 4.2) broken-authorization flaw (CWE-863), and the available signals converge on it being a low real-world priority rather than an urgent one. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) shows network reach but high attack complexity ('under certain conditions'), required low privileges (a valid authenticated fine-grained PAT), and only Low confidentiality and Low integrity impact with no availability impact. A public proof-of-concept exists via the HackerOne report (#3893467), which raises reproducibility, but publicly available exploit code is distinct from active exploitation: this CVE is NOT on CISA KEV, and no EPSS score was supplied in the input, so widespread opportunistic exploitation is not evidenced. The key limiter is that an attacker must already possess a legitimate project-scoped fine-grained PAT, so this is a privilege-boundary/scope-escalation issue usable by an existing authenticated insider, not an unauthenticated internet-facing breach. Net assessment: a genuine but narrow authorization defect - patch in normal cycles rather than treat as an emergency. Missing data to note: no EPSS probability and no KEV entry were provided, so exploitation likelihood is inferred only from PoC existence and the CVSS vector.

An authenticated GitLab user who has been issued a project-scoped fine-grained Personal Access Token uses that token, under specific conditions, to send API requests that modify integrations belonging to a group that lies outside the token's intended scope. Because a public proof-of-concept exists (HackerOne #3893467), the request sequence to trigger the incorrect authorization check is reproducible by an attacker who already holds a valid token.