Incorrect authorization in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-103549
Published: October 13, 2026
Vulnerability identifier: #VU154171
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-103549
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to remove package registry metadata restricted by package protection rules.
The vulnerability exists due to improper authorization checks in the package registry when handling metadata removal operations. A remote privileged user can perform metadata removal operations to remove package registry metadata restricted by package protection rules.
Maintainer-role permissions are sufficient even when the applicable protection rules reserve the operation for higher roles.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-103549
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2