Vulnerability · Published Apr 8, 2026 · Assigned by GitLab
CVE-2026-1752Incorrect Authorization in GitLab
Medium 4.3
In plain English
A medium-severity incorrect authorization in GitLab from GitLab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 74.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- HackerOne Bug Bounty Report #3533545 technical-description, exploit, permissions-required
- https://gitlab.com/gitlab-org/gitlab/-/work_items/588413
- https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/