Incorrect Authorization in GitLab (CVE-2026-8667)
An authorization vulnerability in GitLab CE/EE allows authenticated users with developer role to modify certain package registry metadata without maintainer-level permissions. This issue affects versions from 17.6 up to but not including 19.0.6, 19.1 up to but not including 19.1.4, and 19.2 up to but not including 19.2.2. The flaw was due to improper authorization checks and has been remediated by GitLab.
AI Analysis
Technical Summary
CVE-2026-8667 is an incorrect authorization vulnerability in GitLab Community and Enterprise Editions. Under certain conditions, an authenticated user with developer role could modify package registry metadata that should require maintainer-level permissions. This occurs because of improper authorization checks in affected versions. The vulnerability affects GitLab versions >=17.6 <19.0.6, >=19.1 <19.1.4, and >=19.2 <19.2.2. GitLab has released patches to address this issue.
Potential Impact
The vulnerability allows users with developer role to perform unauthorized modifications to package registry metadata, potentially impacting the integrity of package data. This could lead to unauthorized changes in package information that should be restricted to maintainers. There are no known exploits in the wild reported at this time.
Mitigation Recommendations
A patch is available and has been released by GitLab. Users should upgrade affected GitLab CE/EE instances to versions 19.0.6 or later, 19.1.4 or later, and 19.2.2 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.
Incorrect Authorization in GitLab (CVE-2026-8667)
Description
An authorization vulnerability in GitLab CE/EE allows authenticated users with developer role to modify certain package registry metadata without maintainer-level permissions. This issue affects versions from 17.6 up to but not including 19.0.6, 19.1 up to but not including 19.1.4, and 19.2 up to but not including 19.2.2. The flaw was due to improper authorization checks and has been remediated by GitLab.
Affected software
pkg:github/gitlab-org/gitlabRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8667 is an incorrect authorization vulnerability in GitLab Community and Enterprise Editions. Under certain conditions, an authenticated user with developer role could modify package registry metadata that should require maintainer-level permissions. This occurs because of improper authorization checks in affected versions. The vulnerability affects GitLab versions >=17.6 <19.0.6, >=19.1 <19.1.4, and >=19.2 <19.2.2. GitLab has released patches to address this issue.
Potential Impact
The vulnerability allows users with developer role to perform unauthorized modifications to package registry metadata, potentially impacting the integrity of package data. This could lead to unauthorized changes in package information that should be restricted to maintainers. There are no known exploits in the wild reported at this time.
Mitigation Recommendations
A patch is available and has been released by GitLab. Users should upgrade affected GitLab CE/EE instances to versions 19.0.6 or later, 19.1.4 or later, and 19.2.2 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6qfh-3rvh-8x4w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-8667"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a7cd3e2bf8831d53917ffe1
Added to database: 08/12/2026, 20:13:22 UTC
Last enriched: 08/18/2026, 14:49:00 UTC
Last updated: 09/25/2026, 01:47:46 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.