Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T18:18:16.283Z",
  "pubdate": "2026-08-12T18:18:16.283Z",
  "executiveSummary": "An improper authorization vulnerability has been identified within the package registry component of GitLab CE/EE. This security flaw allows an authenticated user assigned a developer role to improperly modify certain package registry metadata without possessing the required maintainer-level permissions. The vulnerability impacts GitLab CE/EE versions ranging from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.\nThe risk implication centers on privilege boundary violation and potential supply chain integrity degradation. While exploitation requires prior authentication within the platform and specific developer-level access, the flaw enables malicious or compromised actors to bypass intended role-based access control (RBAC) mechanisms. Successful exploitation grants unauthorized control over package metadata assets, risking the integrity of software artifacts managed within the affected GitLab instances.",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization checks implemented within the package registry metadata modification pathways of GitLab CE/EE. Specifically, the application logic fails to properly validate whether an authenticated API consumer or web interface user holds the necessary maintainer role before processing specific metadata update requests.\nThe affected component is the GitLab package registry management module, which handles software package assets and associated metadata across versions 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The vulnerability requires network access to the GitLab instance and assumes an attack vector executed by an authenticated user who possesses at least a developer role within the target project or group context.\nThe attack flow unfolds through the following sequence: an attacker authenticates to the GitLab instance with valid developer-level credentials. The attacker targets specific package registry endpoints responsible for metadata modification. Due to the absence of rigorous server-side authorization enforcement, the application processes the incoming modification request despite the session lacking maintainer privileges. The backend code executes the update operation on the package registry metadata without validating role boundaries, resulting in unauthorized state changes to the package assets.\nThe post-exploitation impact includes unauthorized tampering with package metadata, which can disrupt dependency resolution, mislead consumers regarding package provenance, or facilitate secondary downstream attacks by altering artifact attributes."
}