CVE-2026-9268: 
GitLab Análise e mitigação de vulnerabilidades

CVE-2026-9268 is an incorrect authorization vulnerability in GitLab EE that allows authenticated users with limited permissions to modify project CI/CD deployment rollback settings without proper authorization. It affects all GitLab EE versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The vulnerability was disclosed on October 13, 2026, and patches were made available on the same date. It carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization) — the application performs an authorization check when an actor attempts to access a resource or perform an action, but does not correctly perform the check. Specifically, under certain conditions, insufficient access control checks on the project CI/CD deployment rollback settings endpoint allow a high-privilege-but-limited authenticated user to make unauthorized modifications. The attack vector is network-based, requires high privileges, low attack complexity, and no user interaction (GitHub Advisory). The vulnerability was originally reported via HackerOne (report #3687442) and tracked internally at GitLab work item #600934 (GitHub Advisory).

Successful exploitation allows an authenticated user with limited project permissions to modify CI/CD deployment rollback settings beyond their intended authorization scope, resulting in a low integrity impact with no confidentiality or availability impact. This could enable a malicious insider or compromised account to tamper with deployment rollback configurations, potentially disrupting controlled rollback procedures or introducing unauthorized changes to deployment pipelines (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account with high (but limited) privileges, significantly reducing the attack surface (GitHub Advisory).

GitLab has released patched versions addressing this vulnerability: upgrade to 19.2.8 or later (for instances on 13.6–19.2.x), 19.3.5 or later (for 19.3.x), or 19.4.2 or later (for 19.4.x). No specific workaround is documented; upgrading to a fixed version is the recommended remediation. As an interim measure, administrators should review and audit CI/CD deployment configuration permissions for users with limited roles (GitLab Patch Release, GitHub Advisory).