CVE-2026-15387

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/	Release Notes Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/605632	Issue Tracking Vendor Advisory
https://hackerone.com/reports/3754358	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:19.3.0::::enterprise:::

History

No history.

Information

Published : 2026-08-26 14:17

Updated : 2026-08-31 15:41

NVD link : CVE-2026-15387

Mitre link : CVE-2026-15387

CVE.ORG link : CVE-2026-15387

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-349

Acceptance of Extraneous Untrusted Data With Trusted Data

{"id": "CVE-2026-15387", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15387", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:40:37.265223Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "19.1", "lessThan": "19.1.7", "versionType": "semver"}, {"status": "affected", "version": "19.2", "lessThan": "19.2.5", "versionType": "semver"}, {"status": "affected", "version": "19.3", "lessThan": "19.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-26T14:17:07.540", "references": [{"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/605632", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3754358", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-349"}]}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies."}], "lastModified": "2026-08-31T15:41:20.753", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "3C6C042D-06D4-46F2-A318-D90564B13BA6", "versionEndExcluding": "19.1.7", "versionStartIncluding": "19.1.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "80975E60-F9E7-41D6-A1CA-384E3CA3964D", "versionEndExcluding": "19.2.5", "versionStartIncluding": "19.2.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:19.3.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "99734371-8B08-4207-88EB-D23AE5608E9D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}