Vulnerability · Published Oct 13, 2026 · Assigned by GitLab

CVE-2026-81839Incorrect Authorization in GitLab

High 7.7

In plain English

A high-severity incorrect authorization in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 79.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	18.1 – before 19.2.819.3 – before 19.3.519.4 – before 19.4.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/624150
HackerOne Bug Bounty Report #3925062 technical-description, exploit, permissions-required
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/