Authenticated User Permission Flaw in GitLab by GitLab, Inc.
CVE-2026-4868

8.2HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
27 May 2026

What is CVE-2026-4868?

An issue in GitLab EE allows an authenticated user to manipulate specific Duo AI workflows, potentially executing them under another user's identity. This flaw arises from improper user identity resolution during the triggering of Duo AI workflow runners. Affected versions include GitLab EE 18.8 prior to 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Securing proper identity authentication is crucial to prevent misuse and protect user data.

Affected Version(s)

GitLab 18.8 < 18.10.7

GitLab 18.11 < 18.11.4

GitLab 19.0 < 19.0.1

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/594809
https://hackerone.com/reports/3619872
technical-descriptionexploitpermissions-required
https://about.gitlab.com/releases/2026/05/27/patch-releas...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [ahacker1](https://hackerone.com/ahacker1) for reporting this vulnerability through our HackerOne bug bounty program
.