CVE-2026-86341

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86341
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86341.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86341
Aliases
Downstream
MINI (3)
Published
2026-09-16T07:55:46Z
Modified
2026-10-30T10:30:20Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Access Control Check Implemented After Asset is Accessed in GitLab
Details

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production, due to improper access control checks performed after the protected resource was modified.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-1280"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86341.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "17.1"
                        },
                        {
                            "fixed": "19.1.8"
                        },
                        {
                            "introduced": "19.2"
                        },
                        {
                            "fixed": "19.2.6"
                        },
                        {
                            "introduced": "19.3"
                        },
                        {
                            "fixed": "19.3.2"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "17.1"
                        },
                        {
                            "fixed": "19.1.8"
                        },
                        {
                            "introduced": "19.2"
                        },
                        {
                            "fixed": "19.2.6"
                        },
                        {
                            "introduced": "19.3"
                        },
                        {
                            "fixed": "19.3.2"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
b7514f9c21c09a9ed2b258f5cfdd56c88f43864a
Fixed
ec0fce03a55d83fb520d92d1428491e950dd51f4
Introduced
68485a1eb627c9a992f266263157327649822db3
Fixed
684d9581bfefb68c8593331266b69702589d80a3
Introduced
8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6
Fixed
601afd607baae60e14e83e16fb9dea03cf8c7032
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "17.1.0"
                },
                {
                    "fixed": "19.1.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.2.0"
                },
                {
                    "fixed": "19.2.6"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v19.*
v19.2.0-ee
v19.3.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86341.json"