CVE-2026-14341

Received Received - Intake

Authenticated Maintainer Access Bypass in GitLab CE/EE

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-14341

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab_ce	From 12.8 (inc) to 19.0.5 (exc)
gitlab	gitlab_ee	From 12.8 (inc) to 19.0.5 (exc)
gitlab	gitlab_ce	From 19.1.0 (inc) to 19.1.3 (exc)
gitlab	gitlab_ee	From 19.1.0 (inc) to 19.1.3 (exc)
gitlab	gitlab_ce	From 19.2.0 (inc) to 19.2.1 (exc)
gitlab	gitlab_ee	From 19.2.0 (inc) to 19.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab CE/EE allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint. It affects versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1.

Impact Analysis

An attacker with Maintainer access could change protected branch settings, potentially allowing unauthorized code changes or bypassing security controls. This could lead to data breaches or unauthorized modifications in the repository.

Compliance Impact

This vulnerability could lead to unauthorized code changes or data access, which may violate compliance requirements for data integrity and access controls in standards like GDPR and HIPAA.

Mitigation Strategies

Upgrade GitLab CE/EE to version 19.0.5, 19.1.3, or 19.2.1 or later to address the improper authorization issue in the projects API endpoint.

Hi! I’m here to help you understand CVE-2026-14341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70