Skip to main content

GitLab CE/EE EUVDEUVD-2026-57393

| CVE-2026-15423 HIGH
Incorrect Authorization (CWE-863)
2026-08-12 GitLab GHSA-wf8r-f3x5-5p4r
Gitlab Authentication Bypass
8.5
CVSS 3.1 · Vendor: GitLab
Share

Severity by source

Vendor (GitLab) PRIMARY
8.5 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
vuln.today AI
8.5 HIGH

Developer-role authentication is required (PR:L); scope change reflects unauthorized access to protected branch environment secrets beyond normal developer boundaries.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
None

Lifecycle Timeline

3
Patch available
Aug 12, 2026 - 19:02 EUVD
Analysis Generated
Aug 12, 2026 - 18:46 vuln.today
CVE Published
Aug 12, 2026 - 18:05 cve.org
HIGH 8.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

Articles & Coverage 2

News 6 New GitLab Vulnerabilities - 6 High Severity, 5 With POC Aug 13, 2026 News 6 New GitLab Vulnerabilities - 6 High Severity, 5 With POC Aug 12, 2026

AnalysisAI

Improper authorization in GitLab CE/EE pipeline reference validation allows authenticated developer-role users to execute CI/CD pipelines on protected branches they lack push permissions to access, effectively bypassing branch protection policies. All GitLab versions from 19.0 through 19.2 are affected until the respective patch releases. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain or compromise developer-role GitLab account
Delivery
Identify project with protected branch and restricted push access
Exploit
Craft pipeline trigger request exploiting reference validation flaw
Execution
Execute CI/CD pipeline on protected branch without push permissions
Persist
Access protected environment secrets or CI job artifacts
Impact
Deploy unauthorized code to production environment
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated GitLab session with at least developer-role permissions on the target project - unauthenticated attackers cannot exploit this. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.5 score with a Scope:Changed vector (S:C) reflects that successful exploitation allows a developer to influence resources beyond their authorized access boundary - specifically protected branch environments and their associated CI/CD secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A developer-role user on a GitLab instance - such as a malicious insider, compromised contractor account, or attacker who obtained valid credentials - crafts a pipeline trigger API request that abuses the flawed reference validation logic to target a protected branch (e.g., main or release) without holding push permissions. The pipeline executes in the protected branch context, granting the attacker access to protected environment variables, deployment secrets, or the ability to deploy untested or malicious code to a production environment. …
Remediation Upgrade to the nearest patched release: GitLab 19.0.6, 19.1.4, or 19.2.2 as documented in the patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all GitLab deployments to identify instances running versions 19.0, 19.1, or 19.2, and document which protected branches and pipeline configurations are exposed. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitlab

View all
CVE-2021-22205 CRITICAL POC
10.0 Apr 23

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
CVE-2023-7028 CRITICAL POC
10.0 Jan 12

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
CVE-2013-4490 MEDIUM POC
6.5 May 13

The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
CVE-2022-2992 CRITICAL POC
9.9 Oct 17

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
CVE-2018-18843 CRITICAL POC
10.0 Dec 04

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
CVE-2024-45409 CRITICAL POC
9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
CVE-2022-1162 CRITICAL POC
9.8 Apr 04

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
CVE-2022-0735 CRITICAL POC
9.8 Mar 28

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
CVE-2021-22175 CRITICAL POC
9.8 Jun 11

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
CVE-2021-22203 CRITICAL POC
9.8 Apr 02

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
CVE-2019-15741 CRITICAL POC
9.8 Sep 16

An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2019-6960 CRITICAL POC
9.8 Sep 09

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-57393 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy