CVE-2026-103549

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.6 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1

Description Improper authorization checks allow an authenticated user with maintainer-role permissions to remove specific package registry metadata. This action bypasses package protection rules that are intended to restrict such operations to users with higher roles.

Recommendations Update GitLab CE/EE to version 19.2.8 or later. Update GitLab CE/EE to version 19.3.5 or later. Update GitLab CE/EE to version 19.4.2 or later.