GitLab up to 19.2.7/19.3.4/19.4.1 Labels improper authorization

Summaryinfo

A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been declared as problematic. Impacted is an unknown function of the component Labels. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-14210. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in GitLab up to 19.2.7/19.3.4/19.4.1. It has been classified as problematic. Affected is some unknown processing of the component Labels. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity. CVE summarizes:

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation.

The advisory is shared for download at gitlab.com. This vulnerability is traded as CVE-2026-14210 since 06/30/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1548.002.

The vulnerability scanner Nessus provides a plugin with the ID 366853 (Linux Distros Unpatched Vulnerability : CVE-2026-14210), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 19.2.8, 19.3.5 or 19.4.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (366853) and CERT Bund (WID-SEC-2026-3858). Once again VulDB remains the best source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Open Source GitLab

Productinfo

Type

• Bug Tracking Software

Name

• GitLab

Version

• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3
• 19.2.4
• 19.2.5
• 19.2.6
• 19.2.7
• 19.3.0
• 19.3.1
• 19.3.2
• 19.3.3
• 19.3.4
• 19.4.0
• 19.4.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion