CVE-2026-7514: GitLab Package Registry Auth Bypass Flaw

CVE-2026-7514 is an authorization bypass vulnerability in GitLab CE/EE affecting versions 13.9 through 19.3.1. Developers with specific permissions can substitute package files and hide packages from owners. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-7514 Overview

GitLab has patched a missing authorization vulnerability [CWE-862] in the Generic Package Registry of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an authenticated user with Developer-role permissions to substitute package file content and hide packages from their owners. The issue affects all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab addressed the flaw in the 19.3.2, 19.2.6, and 19.1.8 patch releases.

Critical Impact
A Developer-role account can tamper with package artifacts in the Generic Package Registry, undermining supply-chain integrity for downstream consumers.

Affected Products

GitLab CE/EE versions 13.9 up to (but not including) 19.1.8
GitLab CE/EE versions 19.2 up to (but not including) 19.2.6
GitLab CE/EE versions 19.3 up to (but not including) 19.3.2

Discovery Timeline

2026-09-16 - CVE-2026-7514 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-7514

Vulnerability Analysis

The vulnerability resides in GitLab's Generic Package Registry, a feature that stores arbitrary build artifacts scoped to a project. Under normal operation, only users with Maintainer or higher permissions should be able to modify or delete existing package files. GitLab did not enforce this boundary correctly for Developer-role accounts.

An authenticated Developer could overwrite the content of an existing package file with attacker-controlled data. The same authorization gap allowed hiding packages from their legitimate owners, breaking visibility and audit expectations. Because artifacts in the Generic Package Registry are frequently consumed by downstream build pipelines, deployment jobs, and external clients, silent tampering can propagate malicious payloads through the software supply chain.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Generic Package Registry endpoints that handle package file substitution and visibility. Role-based access controls were not consistently applied, permitting the Developer role to perform actions reserved for higher privilege levels.

Attack Vector

Exploitation requires network access to the GitLab instance and valid credentials for an account holding the Developer role on a target project. No user interaction is needed. The attacker issues an authenticated request to the Generic Package Registry API to replace an existing package file or to alter its visibility. Refer to the GitLab Patch Release Note, GitLab Work Item #598708, and HackerOne Report #3683678 for advisory details.

Detection Methods for CVE-2026-7514

Indicators of Compromise

Unexpected PUT or upload requests to /api/v4/projects/:id/packages/generic/ endpoints originating from Developer-role accounts.
Package files whose SHA256 checksums differ from prior versions without a corresponding CI/CD pipeline job or release event.
Generic Package Registry entries that disappear from the UI while still resolvable via the API.

Detection Strategies

Audit GitLab application logs and audit_events for package file overwrites performed by users whose project role is Developer.
Compare current package file hashes against a known-good baseline stored outside GitLab.
Review packages and package_files database tables for records with mismatched created_at and updated_at timestamps.

Monitoring Recommendations

Forward GitLab audit and API logs to a centralized SIEM and alert on package-registry write operations by non-Maintainer users.
Track anomalous spikes in Generic Package Registry write activity per project and per user.
Integrate package hash validation into downstream CI/CD jobs to detect artifact substitution at consumption time.

How to Mitigate CVE-2026-7514

Immediate Actions Required

Upgrade GitLab CE/EE to 19.3.2, 19.2.6, or 19.1.8 depending on the deployed branch.
Inventory Developer-role assignments on projects that use the Generic Package Registry and revoke unnecessary access.
Re-verify checksums of packages published prior to patching and reject artifacts that cannot be validated against a trusted source.

Patch Information

GitLab released fixed versions 19.3.2, 19.2.6, and 19.1.8. Self-managed administrators should apply the patch release matching their installed branch as documented in the GitLab Patch Release Note. GitLab.com is already running the patched version.

Workarounds

Restrict Generic Package Registry usage to projects where Developer-role users are fully trusted until upgrading.
Enforce protected package versions and immutable release policies at the CI/CD level to reject overwritten artifacts.
Require signed artifacts and validate signatures in downstream consumers to detect tampering independent of GitLab role enforcement.

bash

# Verify installed GitLab version after patching
sudo gitlab-rake gitlab:env:info | grep -i version
# Expected: 19.3.2, 19.2.6, or 19.1.8 (or later)