CVE-2026-6352: GitLab EE Compliance Record Authorization Bypass (CVSS 2.7)

Technical summary

CVE-2026-6352 is an improper authorization vulnerability (CWE-863) in GitLab EE's GraphQL operations that fails to enforce sufficient access controls on compliance violation record modifications. An authenticated user holding auditor-level role permissions can alter compliance records that should be immutable or restricted from modification. The vulnerability stems from insufficient GraphQL operation authorization checks and affects versions 18.2 through 18.11.6, 19.0.0 through 19.0.3, and 19.1.0 through 19.1.1.

Business impact

The risk is primarily to audit integrity and regulatory compliance posture. An auditor with malicious intent or whose credentials are compromised could retroactively alter compliance violation logs, obscuring audit trails and potentially violating regulatory requirements (SOC 2, ISO 27001, HIPAA, etc.). This undermines the trustworthiness of compliance records relied upon for governance and incident investigation. Organizations in heavily regulated sectors face heightened exposure.

Affected systems

GitLab Enterprise Edition versions: 18.2–18.11.6, 19.0.0–19.0.3, and 19.1.0–19.1.1. Community Edition and non-GraphQL workflows are unaffected. Exposure is limited to authenticated users with explicit auditor-level role assignments.

Exploitability

Exploitation requires valid GitLab credentials with auditor role assignment and network access to the GraphQL API. No exploit is public; no zero-click or unauthenticated attack path exists. The high privilege requirement and CVSS 3.1 score of 2.7 (LOW severity) reflect limited practical attack surface. Risk increases if auditor credentials are compromised via phishing, credential stuffing, or lateral movement.

Remediation

Upgrade to GitLab EE 18.11.7, 19.0.4, or 19.1.2 or later. Verify the patched version against GitLab's official advisory. As an interim mitigation, restrict GraphQL API access via network controls or API token policies, and audit user role assignments to ensure least-privilege compliance. Review audit logs for unauthorized compliance record modifications.

Patch guidance

GitLab has released fixes in versions 18.11.7, 19.0.4, and 19.1.2. Prioritize upgrades for 19.1 deployments first (most recent, most likely in active use), then 19.0, then 18.2 branches. Test patches in staging before production rollout. Verify the applied version against GitLab's official release notes to confirm the authorization fix is included.

Detection guidance

Monitor GraphQL audit logs for mutations targeting compliance violation objects by auditor-level users outside normal maintenance windows. Flag modifications to compliance records that lack corresponding business justification. Query GitLab audit events for 'compliance_violation' or 'violation' mutations originating from auditor roles. In SIEM, correlate GraphQL errors (403, 401) from auditor accounts with subsequent successful mutations, which may indicate exploitation. Search admin logs for role assignment changes that elevate users to auditor level.

Why prioritize this

Although CVSS 2.7 is low, prioritize patching based on audit role adoption and regulatory exposure. Organizations subject to strict compliance audit requirements (finance, healthcare, government) should patch urgently to restore audit log integrity. Organizations with fewer auditor-role users and less stringent compliance obligations can defer patching to regular maintenance windows, but should not delay beyond Q3 2026.

Risk score, explained

CVSS 3.1 score of 2.7 reflects low severity: attacks require high privilege (PR:H), produce only integrity impact on audit records (I:L), no confidentiality or availability loss (C:N, A:N), and operate over a network with low complexity (AV:N, AC:L). The score appropriately captures limited exploitability, but business context—compliance posture damage—warrants prioritization above the numerical score alone.

Frequently asked questions