Executive brief
GitLab is a platform used by organizations to manage software development and source code. A security flaw was found where certain users with custom roles could demote or remove group members who have higher administrative privileges than themselves. This could allow a lower-level administrator to disrupt team management or lock out authorized personnel from specific groups.
Technical details
A missing authorization check (CWE-862) in GitLab CE/EE's member management operations allows an authenticated user assigned a custom role to modify the membership status of users with higher privileges. Specifically, an attacker with high-level but restricted permissions can demote or remove group members who should be protected by standard privilege hierarchy rules. The vulnerability affects versions 18.2 through 18.10.2 and is exploited via network requests to member management endpoints. GitLab has addressed this issue in versions 18.8.9, 18.9.5, and 18.10.3 by implementing proper authorization checks.
Affected products
- GitLab GitLab Community Edition (CE) 18.2 to 18.8.8, 18.9 to 18.9.4, 18.10 to 18.10.2
- GitLab GitLab Enterprise Edition (EE) 18.2 to 18.8.8, 18.9 to 18.9.4, 18.10 to 18.10.2
Timeline
- 2026-04-08: advisory: GitLab release blog post published
- 2026-04-08: patched: Versions 18.10.3, 18.9.5, 18.8.9 released
- 2026-04-08: disclosed: CVE-2026-4916 published to NVD