CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

High 8.4 Published 29 Jul 2026 Updated 31 Jul 2026

Authenticated users can modify other users' CI/CD configurations due to improper validation of pipeline schedule inputs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-12436?

CVE-2026-12436 is a high-severity missing authorization vulnerability in Gitlab Gitlab, published on 29 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.

Weakness: CWE-915

Which versions are affected by CVE-2026-12436?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `18.0.0`	`19.0.5, 19.1.3, 19.2.1`

Products include Gitlab Gitlab.

How do I fix CVE-2026-12436?

Upgrade gitlab to a fixed version for your release line: 19.0.5, 19.1.3 or 19.2.1.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-12436 being exploited?

There is no known exploitation of CVE-2026-12436 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2026-12436, GHSA-94p8-87ff-w336, MINI-2p2w-h847-mvxw, MINI-h99h-3rfp-h4mx.