CVE-2026-14210
Received Received - Intake

Authenticated User Label Modification in GitLab CE/EE

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-14210
EUVD
EUVD-2026-98226

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
GitLab GitLab 18.11
GitLab GitLab 19.3
GitLab GitLab 19.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1220 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GitLab CE/EE allows an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels due to incorrect authorization logic on label ownership scope validation. It affects versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

Detection Guidance

This vulnerability can be detected by checking GitLab versions against the patched releases. Verify if your GitLab instance is running versions 19.2.8, 19.3.5, or 19.4.2 or later. Use commands like 'gitlab-rake gitlab:env:info' to check the version. Additionally, review project-scoped fine-grained Personal Access Tokens for unauthorized modifications to group-level labels.

Impact Analysis

An attacker with a project-scoped token could delete or modify group-level labels, potentially disrupting project organization, workflows, or access controls. This could lead to data integrity issues or unauthorized changes in label-based permissions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications or deletions of group-level labels, which may affect data classification, access controls, or audit trails. Unauthorized changes to labels could lead to improper handling of sensitive data, violating GDPR's data integrity principles or HIPAA's security rules for protected health information.

Mitigation Strategies

Upgrade GitLab to a patched version: 19.2.8, 19.3.5, or 19.4.2 or later. Review and revoke any project-scoped fine-grained Personal Access Tokens that may have excessive permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart