CVE-2026-8667
Received Received - Intake

GitLab CE/EE Improper Authorization in Package Registry Metadata

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-8667
EUVD
EUVD-2026-57395

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
gitlab gitlab_ce From 17.6 (inc) to 19.0.6 (exc)
gitlab gitlab_ce From 19.1.0 (inc) to 19.1.4 (exc)
gitlab gitlab_ce From 19.2.0 (inc) to 19.2.2 (exc)
gitlab gitlab_ee From 17.6 (inc) to 19.0.6 (exc)
gitlab gitlab_ee From 19.1.0 (inc) to 19.1.4 (exc)
gitlab gitlab_ee From 19.2.0 (inc) to 19.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-8667 is an Incorrect Authorization vulnerability in GitLab CE/EE. It allows an authenticated user with developer role permissions to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

Detection Guidance

Check GitLab versions to identify if affected versions (17.6 to <19.0.6, 19.1 to <19.1.4, 19.2 to <19.2.2) are running. Review package registry metadata changes for unauthorized modifications by developer-role users.

Impact Analysis

An attacker with developer role access could alter package registry metadata, potentially leading to supply chain attacks, unauthorized package modifications, or distribution of malicious software through the affected GitLab instance.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to package metadata, potentially violating integrity requirements in GDPR or HIPAA for software supply chain security and data protection.

Mitigation Strategies

Upgrade GitLab to the latest patched versions: 19.0.6, 19.1.4, or 19.2.2 or later. Verify maintainer-level permissions for package registry metadata modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart