CVE-2026-1752
Improper Authorization in GitLab API Allows Protected Settings Modification
Publication date: 2026-04-08
Last updated on: 2026-04-14
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 18.9.0 (inc) to 18.9.5 (exc) |
| gitlab | gitlab | From 18.10.0 (inc) to 18.10.3 (exc) |
| gitlab | gitlab | From 11.3.0 (inc) to 18.8.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitLab EE affects versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. It allows an authenticated user with developer-role permissions to modify protected environment settings. This happens because of improper authorization checks in the API, which means the system does not correctly verify if the user has the right to make such changes.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing users with developer-level access to change protected environment settings that they should not be able to modify. This could lead to unauthorized changes in deployment or operational environments, potentially causing disruptions, misconfigurations, or security risks within your development and deployment workflows.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. Specifically, update to version 18.8.9 or later if you are on the 18.8 branch, 18.9.5 or later if on the 18.9 branch, or 18.10.3 or later if on the 18.10 branch. These versions contain the fix for the improper authorization checks that allowed developer-role users to modify protected environment settings.