CVE-2026-1752

MediumCVSS 4.3/10Last modified Jul 25, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 11.3, < 18.8.9; >= 18.9, < 18.9.5; >= 18.10, < 18.10.3

References

https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/588413Broken Link
https://hackerone.com/reports/3533545Permissions Required

Timeline

Published: Apr 8, 2026
Last modified: Jul 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-175204.8The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly k CVE-2026-175225.4The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and wri CVE-2026-175237.8In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet CVE-2026-175247.5Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the CVE-2026-175255.2Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.CVE-2026-175267.2Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role CVE-2026-175277.7In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources CVE-2026-175286.1Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can sup CVE-2026-175296.3A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent CVE-2026-17536.8The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to upd CVE-2026-175306.3A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_tools CVE-2026-175315.0A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/