Executive brief
GitLab's Generic Package Registry, a feature for storing and managing software packages, contains an authorization flaw that allows authenticated developers to substitute package file content and hide packages from their owners. An attacker with developer-level permissions could exploit this to tamper with packages or conceal their modifications, compromising the integrity of the package supply chain.
Technical details
The vulnerability is an improper authorization check (CWE-639: Authorization Bypass) in GitLab's Generic Package Registry that allows authenticated users with developer-role permissions to perform unauthorized package operations. An attacker can substitute package file content and hide packages from legitimate owners by bypassing intended access controls. The flaw affects authenticated users with developer-level access on the network; no additional user interaction is required. A successful exploit allows attackers to manipulate packages and obstruct visibility of their changes, potentially injecting malicious code into software artifacts. Patches are available in GitLab CE/EE versions 19.1.8, 19.2.6, and 19.3.2, released on 2026-09-10.
Affected products
- GitLab GitLab Community Edition 13.9 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- GitLab GitLab Enterprise Edition 13.9 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched