CVE-2026-0934: Incorrect Authorization Vulnerability in GitLab EE Allows Unauthorized Management of Protected Environments

Executive Summary

CVE-2026-0934 is an "Incorrect Authorization" vulnerability impacting GitLab Enterprise Edition (EE). This flaw allows an authenticated user with custom role permissions to view, create, or delete protected environment configurations even when CI/CD visibility is disabled for the project. While the vulnerability is rated as low severity (CVSS 3.8), it poses a risk of privilege escalation and unauthorized changes to sensitive deployment environments. There is currently no evidence of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, organizations using affected versions of GitLab EE should prioritize remediation to prevent potential abuse by malicious insiders or compromised accounts.

Technical Information

CVE-2026-0934 is categorized under CWE-863: Incorrect Authorization. The vulnerability arises due to improper enforcement of authorization checks in the Protected Environments API within GitLab EE. Specifically, an authenticated user with custom role permissions could bypass intended access controls and manipulate protected environment configurations, even when CI/CD visibility is disabled for the project. This could result in unauthorized exposure or modification of sensitive deployment settings.

The vulnerability affects the following versions of GitLab EE: versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. The issue was responsibly disclosed via the HackerOne Bug Bounty Program by the researcher "vulnable" and tracked as GitLab Issue #585961. The vendor released patches in versions 18.11.6, 19.0.3, and 19.1.1 to address the flaw.

From a technical perspective, the vulnerability is exploitable only by authenticated users with specific custom role permissions. The attack vector is network-based, with low attack complexity, but requires high privileges. The impact is limited to confidentiality and integrity, with no direct impact on availability. The vulnerability does not require user interaction and does not affect the underlying system outside of GitLab EE.

Exploitation in the Wild

As of the time of writing, there are no public reports, vendor advisories, or open-source intelligence indicating exploitation of CVE-2026-0934 in the wild. The vulnerability is not included in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no indicators of compromise or breach disclosures have been published. There is also no public proof-of-concept exploit code available. The primary risk remains from malicious insiders or attackers who have already obtained valid credentials with custom role permissions.

APT Groups using this vulnerability

No known APT groups or cybercriminal organizations have been observed exploiting CVE-2026-0934 as of this report. There is no evidence of targeting by any sector, country, or threat actor group. The vulnerability has not been associated with any known campaigns or threat activity clusters.

Affected Product Versions

The following versions of GitLab EE are affected by CVE-2026-0934: versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. All organizations running these versions are at risk and should upgrade to the latest patched releases as soon as possible.

Workaround and Mitigation

The primary mitigation is to upgrade GitLab EE to a fixed version: 18.11.6 or later for the 17.9–18.11.x branch, 19.0.3 or later for the 19.0.x branch, and 19.1.1 or later for the 19.1.x branch. There are no effective workarounds for this vulnerability other than applying the vendor-supplied patches. Organizations should also review and restrict custom role permissions, especially for users with access to protected environments, and monitor for unusual activity in protected environment configurations.

Indicators of Compromise

The following caveat applies: Indicators of compromise are point-in-time and should be validated before enforcement. No public indicators of compromise were available at the time of writing.

References

Rescana is here for you

Rescana provides a comprehensive Third-Party Risk Management (TPRM) platform that empowers organizations to continuously monitor, assess, and mitigate cyber risks across their vendor ecosystem. Our platform delivers actionable intelligence, automated workflows, and deep visibility into your supply chain security posture. We are happy to answer questions at info@rescana.com.