CVE-2026-16794

MediumCVSS 4.3/10Last modified Sep 28, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 18.11, < 19.1.8; >= 19.2, < 19.2.6; >= 19.3, < 19.3.2

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/606750Broken Link
https://hackerone.com/reports/3785754Permissions Required

Timeline

Published: Sep 16, 2026
Last modified: Sep 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-167967.3Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allo CVE-2026-167974.3The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Refer CVE-2026-167986.5Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows CVE-2026-167995.0Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an au CVE-2026-16807.8Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Windows allows a local CVE-2026-168008.8Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier a CVE-2026-168018.8Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier CVE-2026-168026.5Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local CVE-2026-168048.3Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to poten CVE-2026-168058.8Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-168068.8Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-168078.8Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via