Authorization Flaw in GitLab CE/EE Allows Modification of External Integrations
CVE-2026-78335
4.2MEDIUM
What is CVE-2026-78335?
A vulnerability in GitLab CE/EE affects versions prior to 19.2.8, 19.3.5, and 19.4.2, where an authenticated user with a project-scoped fine-grained Personal Access Token could exploit incorrect authorization checks. This flaw permits such users to modify integrations associated with groups outside their token's designated scope, presenting a significant security risk for users relying on GitLab's integration settings.
Affected Version(s)
GitLab 19.1 < 19.2.8
GitLab 19.3 < 19.3.5
GitLab 19.4 < 19.4.2
References
CVSS V3.1
Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Thanks [mahoraga007](https://hackerone.com/mahoraga007) for reporting this vulnerability through our HackerOne bug bounty program