Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-08T20:46:43 gitlab: GitLab EE: Auditor-level users can modify compliance records via improper authorization in GraphQL 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CWE-639

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper authorization on certain GraphQL operations.

A flaw was found in GitLab Enterprise Edition (EE). An authenticated user with auditor-level access could modify compliance violation records. This was possible due to improper authorization on certain GraphQL operations, allowing them to bypass intended access controls.

OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-6352 https://nvd.nist.gov/vuln/detail/CVE-2026-6352 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/ https://gitlab.com/gitlab-org/gitlab/-/work_items/596789 https://hackerone.com/reports/3631344