CVE-2026-12436

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.0 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0

Description An issue exists in the Pipeline Schedule API where improper validation of user-supplied attributes when processing pipeline schedule inputs allows an authenticated user to modify CI/CD configuration belonging to another user. This is caused by insufficient control over the modification of dynamically defined object characteristics.

Recommendations Update GitLab CE/EE versions 18.0 through 19.0.4 to version 19.0.5. Update GitLab CE/EE versions 19.1 through 19.1.2 to version 19.1.3. Update GitLab CE/EE versions 19.2 through 19.2.0 to version 19.2.1.