Incorrect authorization in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-14341
Published: July 29, 2026 / Updated: July 30, 2026
Vulnerability identifier: #VU140481
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14341
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify protected branch configuration.
The vulnerability exists due to improper authorization in a projects API endpoint when handling API requests. A remote privileged user can send a crafted API request to modify protected branch configuration.
The issue affects users with the Maintainer role under certain conditions.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-14341
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1
Gitlab Community Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1
Gitlab Community Edition - addressed in versions 19.0.5, 19.1.3, 19.2.1