CVE-2026-4398

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.3 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0

Description An issue exists on self-managed instances where missing namespace validation allows an authenticated user to assign compliance frameworks to their own project from namespaces they are not authorized to access.

Recommendations Update GitLab EE versions 18.3 through 19.1.6 to version 19.1.7. Update GitLab EE versions 19.2 through 19.2.4 to version 19.2.5. Update GitLab EE versions 19.3 through 19.3.0 to version 19.3.1.