CVE-2026-6352

Received Received - Intake

Authenticated Auditor Access Bypass in GitLab EE

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper authorization on certain GraphQL operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-6352

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab_ee	From 18.2 (inc) to 18.11.7 (exc)
gitlab	gitlab_ee	From 19.0 (inc) to 19.0.4 (exc)
gitlab	gitlab_ee	From 19.1 (inc) to 19.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab Enterprise Edition affects versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. Under certain conditions, an authenticated user with auditor-level access could exploit improper authorization in specific GraphQL operations to modify compliance violation records.

Impact Analysis

The vulnerability allows an authenticated auditor-level user to alter compliance violation records, which could undermine the integrity and trustworthiness of compliance data within GitLab. This could lead to inaccurate compliance reporting and potentially conceal violations.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. Specifically, update to version 18.11.7 or later if you are on the 18.2 to 18.11 series, 19.0.4 or later if you are on the 19.0 series, or 19.1.2 or later if you are on the 19.1 series.

This vulnerability affects authenticated users with auditor-level access who could modify compliance violation records due to improper authorization on certain GraphQL operations. Ensuring your GitLab instance is updated will prevent exploitation.

Compliance Impact

This vulnerability allows an authenticated user with auditor-level access to modify compliance violation records due to improper authorization on certain GraphQL operations.

Modifying compliance violation records could undermine the integrity and reliability of compliance reporting, potentially impacting adherence to standards and regulations such as GDPR and HIPAA that require accurate and tamper-proof audit trails.

Hi! I’m here to help you understand CVE-2026-6352. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70