Database/Control plane, storage & DevOps
GitLab EE: insufficient access control lets a limited user modify project CI/CD deployment rollback settings
Impact
Insufficient access control checks allow an authenticated user with limited permissions to change a project's CI/CD deployment rollback settings. Where GitLab EE drives deployments onto a fleet, rollback configuration decides what can be re-deployed and under what conditions, so an unauthorized change is a change to deployment behaviour rather than to code. Integrity impact only, and the affected setting is narrow - this is a permissions-boundary bug, not a route to code execution on runners. The affected range is long, from 13.6 onward.
Who can reach it
Authenticated GitLab EE user with project permissions below those intended for the setting, over the network. The record rates privileges required as high.
What to do
Upgrade self-hosted GitLab EE to 19.2.8, 19.3.5 or 19.4.2 and restart the application - the same patch release that covers the other GitLab issues in this batch. Afterwards, review deployment rollback settings on projects with broad membership for changes made before the upgrade.
References
Related entries
- Sunbird Power IQ 9.2.0 API: Error-based SQL injection through an outdated API endpoint with missing input validationCVE-2025-55703 · Sunbird Power IQ 9.2.0 APILow
- Trivy: Terraform filesystem functions read paths above the scan root during misconfig scansCVE-2026-104994 · Trivy (Terraform misconfiguration scanner, filesystem functions)Low
- Lenovo ThinkSystem SR670 V2 (shipped in Manufacturing Mode): SR670 V2 servers built between roughly June 2021 and JulyCVE-2024-23591 · Lenovo ThinkSystem SR670 V2 (shipped in Manufacturing Mode)Low
- Linuxfabrik monitoring plugins: symlink attack on predictable /tmp SQLite caches lets a local user write as rootCVE-2026-53759 · linuxfabrik-lib db_sqlite.py (Monitoring Plugins cache databases in /tmp)Low
- Grafana Alerting: Editor can exfiltrate contact point credentials by retargeting the test endpointCVE-2025-12141 · Grafana Alerting (contact point test, redacted secure settings)Low
- QCT (Quanta Cloud Technology) server security centre: QCT firmware is unmeasurable from public data despiteNCVD-2026-012-qct-quanta-cloud-technology-serv · QCT (Quanta Cloud Technology) server security centreUnscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.