CVE-2026-7514: 
GitLab vulnerability analysis and mitigation

CVE-2026-7514 is a missing authorization vulnerability in GitLab CE/EE's Generic Package Registry that allows authenticated users with developer-role permissions to substitute package file content and hide packages from their owners. It affects all GitLab versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The vulnerability was published on September 16, 2026, and has a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization) — the Generic Package Registry fails to perform adequate authorization checks when a developer-role user attempts to modify or overwrite package file content belonging to other owners. An authenticated attacker with at minimum developer-level access can exploit this over the network with low attack complexity and no user interaction required, by sending crafted requests to the Generic Package Registry API to substitute package files or suppress package visibility from legitimate owners (GitHub Advisory). The vulnerability was originally reported via HackerOne (report #3683678).

Successful exploitation allows an authenticated developer-role user to tamper with package file content in the Generic Package Registry and hide packages from their rightful owners, resulting in a low integrity impact with no confidentiality or availability impact. This could be used to introduce malicious or altered build artifacts into a project's package registry, potentially affecting downstream consumers of those packages. Supply chain integrity is the primary risk, as developers or CI/CD pipelines consuming tampered packages may unknowingly use malicious content (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable with only partial technical impact. The EPSS score is approximately 0.325% (26th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authentication: Log in to a GitLab instance with an account that has at minimum developer-role permissions on a target project.
2. Identify target packages: Browse the Generic Package Registry of the target project to identify packages owned by other users or groups.
3. Craft malicious upload request: Use the GitLab Generic Package Registry API (e.g., PUT /api/v4/projects/:id/packages/generic/:package_name/:package_version/:file_name) to upload a modified or malicious file, overwriting an existing package file without proper authorization checks.
4. Hide packages: Leverage the improper authorization flaw to manipulate package visibility, hiding legitimate packages from their owners to obscure the tampering.
5. Impact downstream consumers: Any CI/CD pipeline or developer that subsequently downloads the tampered package will receive the attacker-substituted content, potentially executing malicious code or using compromised artifacts (GitHub Advisory).

• Logs: GitLab application logs showing unexpected PUT requests to the Generic Package Registry API (/api/v4/projects/:id/packages/generic/) from developer-role accounts that do not own the targeted packages; repeated package upload events for packages owned by different users.
• Package Registry Activity: Packages with unexpected file content changes or version overwrites; packages that have become hidden or inaccessible to their original owners.
• Audit Events: GitLab audit log entries showing package file uploads or modifications by users who are not the package owner; unusual access patterns to the Generic Package Registry from developer accounts.

GitLab has released patched versions addressing this vulnerability: 19.1.8, 19.2.6, and 19.3.2. All GitLab CE/EE installations running versions from 13.9 up to (but not including) these fixed releases should upgrade immediately (GitHub Advisory, GitLab Patch Release). As a compensating control, administrators should review and restrict developer-role access to the Generic Package Registry, and monitor package registry activity for unauthorized modifications or hidden packages.

GBHackers covered the vulnerability as part of broader GitLab security patch coverage shortly after disclosure (GBHackers). Beyond Machines also noted the patch release in the context of GitLab's September 2026 security updates. No significant independent researcher commentary or notable social media discussion has been identified for this specific CVE.