Executive brief
GitLab has fixed a security vulnerability in its software development platform that could allow a logged-in user to modify the automated build and deployment (CI/CD) settings of other users. This flaw could be used to interfere with software delivery pipelines or potentially gain unauthorized access to sensitive deployment processes. Organizations using self-managed GitLab instances should upgrade to the latest patched versions immediately to prevent unauthorized configuration changes.
Technical details
A mass assignment vulnerability (CWE-915) exists in the GitLab Pipeline Schedule API due to improper validation of user-supplied attributes. An authenticated attacker with network access can exploit this by providing unexpected attributes when interacting with pipeline schedule inputs. Under certain conditions, this allows the attacker to modify CI/CD configurations belonging to other users. The vulnerability is tracked as CVE-2026-12436 and has been patched in GitLab versions 19.2.1, 19.1.3, and 19.0.5. The exploit requires low privileges but has a high impact on integrity and confidentiality due to the scope change (S:C) in the CVSS vector.
Affected products
- GitLab GitLab Community Edition (CE) 18.0 to 19.0.4, 19.1 to 19.1.2, 19.2 to 19.2.0
- GitLab GitLab Enterprise Edition (EE) 18.0 to 19.0.4, 19.1 to 19.1.2, 19.2 to 19.2.0
Timeline
- 2026-07-29: patched: GitLab released versions 19.2.1, 19.1.3, and 19.0.5 to address the issue.
- 2026-07-29: advisory: NVD and GitLab published the vulnerability details.