CVE-2026-1663 — Missing Authorization in GitLab

Back Back to CVE browser

MEDIUM

Missing Authorization in GitLab

Published Mar 11, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.19%

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in the group import process under certain circumstances.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  14.4
  Status
  affected
  Constraints
  <18.7.6
- Version
  18.8
  Status
  affected
  Constraints
  <18.8.6
- Version
  18.9
  Status
  affected
  Constraints
  <18.9.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
14.4	affected	<18.7.6
18.8	affected	<18.8.6
18.9	affected	<18.9.2

Remediation

Vendor solution

Upgrade to versions 18.7.6, 18.8.6, 18.9.2 or above.

Metrics

0.19% 0.00190

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00190

Score over time

Mar–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.19% (0.00190)	7.77th	v5 (v2026.06.15)
Jun 15, 2026	0.19% (0.00190)	8.72th	v5 (v2026.06.15)
Mar 12, 2026	0.01% (0.00010)	1.06th	v4 (v2025.03.14)

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/588207
Broken Link
https://hackerone.com/reports/3485548
technical-descriptionexploitpermissions-requiredPermissions Required

Link	Providers	Tags
https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/		Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/588207		Broken Link
https://hackerone.com/reports/3485548		technical-descriptionexploitpermissions-requiredPermissions Required