CVE-2026-6352
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An improper authorization vulnerability in GraphQL operations in GitLab EE allowed an authenticated user with auditor-level access to modify compliance violation records under certain conditions. Affected versions are 18.2 through 18.11.7, 19.0 through 19.0.4, and 19.1 through 19.1.2.
Risk Assessment
The organization faces the risk of unauthorized modification of compliance records, potentially hiding violations and compromising audit integrity.
Recommendation
Immediately upgrade GitLab EE to version 18.11.7, 19.0.4, or 19.1.2, depending on the release branch in use.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper authorization on certain GraphQL operations.