CVE-2026-78335

MediumCVSS 4.2/10Last modified Oct 16, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-783367.5Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of avail CVE-2026-783374.8Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticate CVE-2026-783397.1Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Res CVE-2026-78349.8A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the file /cgi/a CVE-2026-783406.7Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricte CVE-2026-783417.2Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high pr CVE-2026-78353.1A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service CVE-2026-783558.7A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths out CVE-2026-783565.3The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve CVE-2026-783579.1Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its pa CVE-2026-783584.3Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In part CVE-2026-783595.4OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multipl