CVE-2026-8667: GitLab Authorization Bypass Vulnerability

CVE-2026-8667 Overview

CVE-2026-8667 is an improper authorization vulnerability [CWE-863] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an authenticated user with the Developer role to modify certain package registry metadata that should require Maintainer-level permissions. GitLab has released patches addressing the issue in versions 19.0.6, 19.1.4, and 19.2.2.

The vulnerability affects all GitLab CE/EE versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Exploitation requires an authenticated account with Developer privileges and a network-reachable GitLab instance. No user interaction is needed.

Critical Impact
Authenticated Developer-role users can bypass authorization checks and tamper with package registry metadata, undermining supply chain integrity within affected GitLab projects.

Affected Products

GitLab CE/EE versions 17.6 through 19.0.5
GitLab CE/EE versions 19.1 through 19.1.3
GitLab CE/EE versions 19.2 through 19.2.1

Discovery Timeline

2026-08-12 - CVE-2026-8667 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-8667

Vulnerability Analysis

The vulnerability is an improper authorization flaw [CWE-863] in GitLab's package registry component. GitLab's role-based access control model reserves package registry metadata modification for users with Maintainer or higher privileges. Under specific conditions, the authorization checks fail to enforce this requirement, allowing Developer-role users to perform actions outside their intended permission scope.

Because the package registry stores artifacts consumed by downstream builds and deployments, unauthorized metadata modification introduces supply chain risk. An attacker with a Developer account could alter metadata associated with published packages, potentially misleading consumers about package provenance or state.

The issue is limited in scope to integrity impact. It does not disclose confidential information and does not directly impact availability of the GitLab instance.

Root Cause

The root cause is missing or incorrect authorization enforcement in the code path that processes package registry metadata updates. The affected endpoint validates authentication but does not consistently verify that the requesting user holds the Maintainer role required for the operation, per GitLab's documented permission matrix.

Attack Vector

Exploitation requires network access to the GitLab instance and valid credentials for an account with at least Developer role membership in the target project. The attacker issues API requests targeting the package registry metadata endpoints. Because Developer-role accounts are commonly provisioned across engineering teams, the pool of potential abusers within a large GitLab tenant can be significant.

No verified proof-of-concept code has been published. Technical details are tracked in GitLab Work Item #600228 and HackerOne Report #3598070.

Detection Methods for CVE-2026-8667

Indicators of Compromise

Unexpected changes to package registry metadata performed by user accounts holding only the Developer role.
API requests to package registry metadata endpoints originating from Developer accounts that historically only publish or read packages.
Audit log entries showing metadata edits without a corresponding Maintainer approval or activity trail.

Detection Strategies

Review GitLab audit events for package registry write operations and correlate the acting user's project role at the time of the event.
Baseline normal package publishing behavior per project and alert on metadata modifications outside that baseline.
Cross-reference package registry activity with CI/CD pipeline runs to identify metadata changes not tied to a legitimate build.

Monitoring Recommendations

Enable and centralize GitLab audit logging, forwarding events to a SIEM for long-term retention and correlation.
Monitor GitLab API access logs for anomalous request patterns targeting /api/v4/projects/:id/packages and related endpoints.
Alert on any package metadata change performed outside of change windows or by users who do not typically maintain packages.

How to Mitigate CVE-2026-8667

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.0.6, 19.1.4, or 19.2.2, matching your current release branch.
Audit recent package registry metadata changes for the affected version range and validate them against expected Maintainer activity.
Review project membership and remove unnecessary Developer-role grants on projects with sensitive package registries.

Patch Information

GitLab addressed the vulnerability in the GitLab Patch Release 19.2.2 and corresponding backports to the 19.0.x and 19.1.x branches. Self-managed administrators should apply the patch matching their deployment version. GitLab.com is operated on patched releases by GitLab.

Workarounds

No official workaround has been published; upgrading to a fixed release is the recommended remediation.
As a compensating control, restrict Developer-role membership on projects that publish packages until the patch is applied.
Increase audit log review frequency for package registry activity during the exposure window.

bash

# Verify GitLab version after upgrade (self-managed)
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example: query recent package registry audit events via API
curl --header "PRIVATE-TOKEN: <admin_token>" \
  "https://gitlab.example.com/api/v4/audit_events?created_after=2026-07-01"