CVE-2026-0934 Overview
CVE-2026-0934 is an authorization flaw in GitLab Enterprise Edition (EE) that allows authenticated users with custom role permissions to view, create, or delete protected environment configurations. The issue affects GitLab EE versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. Under specific conditions, the access control logic fails to honor the project setting that disables CI/CD visibility. As a result, custom-role users can manipulate protected environment data they should not be able to reach. The flaw is tracked under CWE-863: Incorrect Authorization.
Critical Impact
An authenticated attacker with custom role permissions can bypass project-level CI/CD visibility restrictions to access or alter protected environment configurations.
Affected Products
- GitLab EE versions 17.9 through versions before 18.11.6
- GitLab EE versions 19.0 through versions before 19.0.3
- GitLab EE versions 19.1 through versions before 19.1.1
Discovery Timeline
- 2026-06-25 - CVE-2026-0934 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-0934
Vulnerability Analysis
The vulnerability is an authorization bypass affecting GitLab EE's protected environment configuration endpoints. GitLab projects can disable CI/CD visibility to restrict who can see pipeline-related metadata. The flaw causes this restriction to be ignored when a user holds specific custom role permissions. Such users can view, create, or delete protected environment configurations despite the visibility setting. The result is unintended exposure and modification of deployment safeguards used to gate production releases.
Root Cause
The root cause is incorrect authorization logic [CWE-863] in the code path serving protected environment operations. The permission check evaluates the custom role's granted capabilities without re-validating the project's CI/CD visibility configuration. This inconsistency between feature-visibility settings and role-based access enforcement allows the bypass.
Attack Vector
Exploitation requires an authenticated account holding a custom role granted the relevant permissions on the target project. The attacker issues network requests against GitLab API or UI endpoints that manage protected environments. No user interaction is required. Because the privileges needed are elevated, the practical attack surface is limited to insiders or compromised maintainer-level accounts. See the HackerOne Report #3508760 and the GitLab Work Item Overview for additional technical details.
Detection Methods for CVE-2026-0934
Indicators of Compromise
- Unexpected create, update, or delete events on protected environment configurations originating from users with custom roles.
- API calls to protected environment endpoints on projects where CI/CD visibility is disabled.
- Audit log entries showing protected environment changes outside of normal release windows or change tickets.
Detection Strategies
- Correlate GitLab audit events for protected environment modifications with the acting user's role assignments to flag custom-role activity.
- Alert on any access to /api/v4/projects/:id/protected_environments endpoints when the project's CI/CD feature visibility is set to disabled.
- Baseline normal protected environment change patterns per project and alert on deviations.
Monitoring Recommendations
- Forward GitLab audit and application logs to a centralized SIEM and retain protected environment events for forensic review.
- Review custom role definitions and inventory all users assigned non-default roles across EE projects.
- Validate that CI/CD visibility settings align with intended access control and report drift.
How to Mitigate CVE-2026-0934
Immediate Actions Required
- Upgrade GitLab EE to version 18.11.6, 19.0.3, or 19.1.1 or later, as appropriate to your release track.
- Audit custom role definitions and remove unnecessary protected environment permissions until patched.
- Review recent audit logs for unauthorized changes to protected environment configurations.
Patch Information
GitLab has released fixes in versions 18.11.6, 19.0.3, and 19.1.1. Refer to the GitLab Release Patch Note for upgrade instructions and verification steps.
Workarounds
- Temporarily revoke custom role assignments that grant protected environment permissions on sensitive projects.
- Restrict membership on projects with disabled CI/CD visibility to trusted maintainers until patches are applied.
- Enable enhanced audit logging on affected projects to detect attempted exploitation during the remediation window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
