Skip to content
VulniPulse
Sign in
Advisory severityLow2.7GitLab Updated

Low [CVE-2026-103549] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks

This low-severity GitLab advisory covers CVE-2026-103549 affecting GitLab.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-103549 Source published Source updated

VulniPulse record published Record updated

CVE-2026-103549
Affected products & platforms
GitLabUnclassified
Open source advisory

Android app · Google Play

Monitor future GitLab CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.

Affected versions
  • before 19.2.8
  • before 19.3.5
  • before 19.4.2

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Fixed versions
  • 19.2.8
  • 19.3.5
  • 19.4.2

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Mitigation checklist

Temporary workarounds
  • GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.

Official advisory · high-confidence parse· fetched 1 day ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.