CVE ID Withdrawn: No Vulnerability Confirmed

Publication date: 2026-04-08

Last updated on: 2026-08-27

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-08

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-04-09

EPSS Evaluated

N/A

NVD

CVE-2026-4398

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority, so there is no valid vulnerability information available.

Impact Analysis

Since the CVE ID has been rejected or withdrawn, there is no known vulnerability or impact associated with it.

Compliance Impact

There is no information about this vulnerability affecting compliance with any standards or regulations because the CVE ID was rejected or withdrawn.

Hi! I’m here to help you understand CVE-2026-4398. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70