Loading vulnerability…
Incorrect Authorization in GitLab EE Compliance Violation Management
CVE-2026-6352 is an incorrect authorization vulnerability in GitLab Enterprise Edition affecting compliance violation management. In affected versions, certain GraphQL operations did not enforce authorization correctly, which under specific conditions allowed an authenticated user with auditor-level access to modify compliance violation records. The flaw is an access control failure in the application’s authorization logic rather than a memory-safety issue, and it impacts the integrity of compliance-related records within GitLab EE.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated auditor-level user to make unauthorized changes to compliance violation records. This can compromise the integrity and trustworthiness of compliance tracking data, potentially interfering with governance, auditability, and internal compliance workflows. Based on the available information, the primary impact is unauthorized data modification rather than code execution or privilege escalation to broader administrative control.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting auditor-level access to only strictly necessary accounts and reviewing use of compliance-related GraphQL functionality. Monitor and audit changes to compliance violation records for unauthorized modifications until the upgrade can be completed. A complete fix requires upgrading to a patched version.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 18.11.7 and later in the 18.11 series, 19.0.4 and later in the 19.0 series, and 19.1.2 and later in the 19.1 series. Self-managed deployments running affected versions should be updated promptly.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.