CVE-2026-9268
Received Received - Intake

Unauthorized CI/CD Rollback Modification in GitLab EE

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-9268
EUVD
EUVD-2026-98227

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
GitLab GitLab 13.6
GitLab GitLab 19.3
GitLab GitLab 19.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GitLab EE allows an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization. It exists due to insufficient access control checks in versions before 19.2.8, 19.3.5, and 19.4.2.

Detection Guidance

This vulnerability affects GitLab EE versions 13.6 to 19.2.7, 19.3 to 19.3.4, and 19.4 to 19.4.1. To detect it, check your GitLab version using the command 'gitlab-rake gitlab:env:info' or 'cat /opt/gitlab/version-manifest.txt'. If your version falls within the affected range, update to the patched versions (19.2.8, 19.3.5, or 19.4.2).

Impact Analysis

An attacker with limited access could alter deployment rollback settings, potentially causing unauthorized changes to project deployments or disrupting CI/CD pipelines.

Compliance Impact

This vulnerability could potentially impact compliance with standards requiring strict access controls, such as GDPR (data protection) or HIPAA (health information), by allowing unauthorized modifications to CI/CD deployment settings. However, the specific impact depends on how GitLab is used in a regulated environment.

Mitigation Strategies

Upgrade GitLab EE to version 19.2.8, 19.3.5, or 19.4.2 or later to address the insufficient access control checks in CI/CD deployment rollback settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9268. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart