CVE-2026-14341 Overview
CVE-2026-14341 is an improper authorization vulnerability [CWE-862] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. Under certain conditions, an authenticated user with the Maintainer role can modify protected branch configuration through a projects API endpoint. GitLab has remediated the issue in the affected release branches.
Critical Impact
An authenticated Maintainer can bypass authorization checks and alter protected branch rules, undermining code review controls and enabling unauthorized changes to protected branches.
Affected Products
- GitLab CE/EE versions 12.8 through 19.0.4
- GitLab CE/EE versions 19.1 through 19.1.2
- GitLab CE/EE versions 19.2 through 19.2.0
Discovery Timeline
- 2026-07-29 - CVE-2026-14341 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-14341
Vulnerability Analysis
The vulnerability resides in a projects API endpoint that fails to enforce complete authorization checks on protected branch configuration changes. A user assigned the Maintainer role can invoke the endpoint and modify branch protection settings that should require higher privileges. The issue is classified as Missing Authorization [CWE-862].
Protected branches in GitLab enforce merge and push controls, code review requirements, and approval workflows. Weakening or removing these protections allows commits to reach protected branches without the required approvals. This directly undermines source code integrity controls in affected GitLab instances.
The EPSS score is 0.326%, indicating low current exploitation likelihood. Exploitation requires authenticated access with the Maintainer role, which limits the attacker population to insiders or accounts obtained through credential compromise.
Root Cause
The API endpoint responsible for protected branch configuration performs insufficient authorization validation. It confirms that the caller holds the Maintainer role but does not verify that the requested action falls within the permission scope granted to that role. This gap allows modifications that policy reserves for Owners or administrators.
Attack Vector
An authenticated user with Maintainer role on a target project sends a crafted request to the vulnerable projects API endpoint. The request modifies protected branch settings such as allowed pushers, merge access levels, or approval requirements. No user interaction is required, and the attack is delivered over the network.
The vulnerability manifests server-side in GitLab's authorization layer for the projects API. No verified proof-of-concept code is publicly available. Refer to the HackerOne Report #3807593 and GitLab Work Item #604665 for further technical details.
Detection Methods for CVE-2026-14341
Indicators of Compromise
- Unexpected changes to protected branch rules on projects, particularly modifications to push_access_levels, merge_access_levels, or approval requirements.
- API audit log entries showing PUT, PATCH, or POST requests to /api/v4/projects/:id/protected_branches from Maintainer accounts.
- Merges or direct pushes to protected branches that bypass previously enforced approval workflows.
Detection Strategies
- Correlate GitLab audit events with project role assignments to flag Maintainer-initiated changes to branch protection.
- Alert on any modification of protected branch configuration outside of change-management windows.
- Baseline the frequency of protected branch API calls per user and alert on statistical outliers.
Monitoring Recommendations
- Forward GitLab audit logs and API access logs to a centralized SIEM for correlation and long-term retention.
- Monitor Git server logs for pushes to protected branches that occurred without the required approvals.
- Review Maintainer role assignments across all projects and flag accounts with anomalous API usage patterns.
How to Mitigate CVE-2026-14341
Immediate Actions Required
- Upgrade GitLab CE/EE to version 19.0.5, 19.1.3, or 19.2.1, whichever aligns with your current release branch.
- Audit recent protected branch configuration changes across all projects and revert unauthorized modifications.
- Review the Maintainer role membership and remove accounts that do not require elevated project access.
Patch Information
GitLab has released patched versions 19.0.5, 19.1.3, and 19.2.1. See the GitLab Patch Release 19.2.1 advisory for the full remediation notice and upgrade instructions. Self-managed instances should apply the patch on the earliest maintenance window.
Workarounds
- Restrict the Maintainer role to trusted personnel until the patch is applied.
- Enforce mandatory audit review of protected branch configuration changes through out-of-band change control.
- Enable two-factor authentication for all accounts holding Maintainer or higher roles to reduce credential compromise risk.
# Upgrade example for Debian/Ubuntu self-managed GitLab
sudo apt-get update
sudo apt-get install gitlab-ee=19.2.1-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-rake gitlab:check
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
