MediumPublic exploit

Improper Access Control in GitLab EE Environments API

IdentifiersCVE-2026-1752CWE-284

CVE-2026-1752 is an improper access control vulnerability in GitLab Enterprise Edition (EE) Environments API. GitLab states that affected versions are all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. Due to improper authorization checks in the API, an authenticated user with developer-role permissions could modify protected environment settings, despite those settings being intended to be restricted.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a user with only developer-level access to alter protected environment settings in GitLab EE projects. This breaks intended privilege boundaries around protected environments and can undermine deployment governance and environment protection controls. The issue is described as medium severity with a CVSS score of 4.3.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, limit or review assignment of developer-role permissions in projects that use protected environments, and monitor for unauthorized changes to protected environment settings via the Environments API. However, no vendor-provided mitigation beyond upgrading is specified in the provided content.

Remediation

Patch, then assume compromise.

Upgrade GitLab EE to a fixed release. GitLab indicates the issue is remediated in 18.8.9, 18.9.5, and 18.10.3. Self-managed customers should upgrade immediately to a patched version. GitLab.com was already patched, and GitLab Dedicated customers did not need to take action.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GitLabGitlabapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

thecyberexpress com vulnerabilitiesNews

Apr 10, 2026

GitLab Security Update Fixes CVE-2026-5173 Flaw

An improper access control vulnerability in GitLab's Environments API.

cyber security newsNews

Apr 9, 2026

GitLab Patches Multiple Vulnerabilities That Enables DoS and Code Injection Attacks

A lower-severity GitLab access control vulnerability that allows developers to modify protected environment settings.

gitlab releasesNews

Apr 8, 2026

GitLab Patch Release: 18.10.3, 18.9.5, 18.8.9 | GitLab

An improper access control vulnerability in the GitLab EE Environments API that could allow an authenticated developer to modify protected environment settings.

docs gitlabNews

Oct 1, 2018

GitLab Patch Release: 18.10.3, 18.9.5, 18.8.9 | GitLab Docs

An improper access control vulnerability in the GitLab EE Environments API that could let a developer-role user modify protected environment settings.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1