Loading vulnerability…
Incorrect Authorization in GitLab EE Group-Level Settings
CVE-2026-13151 is a low-severity improper authorization vulnerability in GitLab Enterprise Edition affecting group-level settings. It affects all versions from 16.10 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. Under certain conditions, the application failed to correctly enforce authorization boundaries on group-level settings operations, allowing an authenticated user to modify settings beyond the permissions intended for their role. The issue is rooted in incorrect authorization controls rather than memory corruption or code injection, and the primary risk is unauthorized alteration of group configuration within GitLab EE.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated user to change group-level settings they should not be permitted to modify. This can result in unauthorized administrative or configuration changes at the group scope, potentially weakening governance, altering security-relevant settings, disrupting expected access-control policy, or changing operational behavior for projects and users associated with the affected group.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by tightly limiting which users have authenticated access to affected GitLab EE instances, especially at group scope, and by reviewing and restricting delegated administrative capabilities where possible. Monitor and audit changes to group-level settings for unauthorized modifications until the upgrade can be completed. A full fix requires upgrading to a patched version.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 18.11.7, 19.0.4, and 19.1.2 or later, depending on the deployment track. Self-managed instances running affected versions should be updated promptly to a supported fixed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.