---
id: CVE-2026-4398
title: >-
  GitLab has remediated an issue in GitLab EE affecting all versions from 18.3
  before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain
  conditions, an authenticated user could have assigned compliance frameworks
  from n…
summary: >-
  GitLab has remediated an issue in GitLab EE affecting all versions from 18.3
  before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain
  conditions, an authenticated user could have assigned compliance frameworks
  from n…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-639
vendor: gitlab
product: gitlab
affected:
  - 'gitlab >= 18.3.0, < 19.1.7'
  - 'gitlab >= 19.2.0, < 19.2.5'
  - gitlab = 19.3.0
patched:
  - gitlab 19.2.5
published: '2026-04-08'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T19:09:33.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4398'
references:
  - url: >-
      https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/
    label: cve@gitlab.com
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/work_items/600360'
    label: cve@gitlab.com
  - url: 'https://hackerone.com/reports/3549150'
    label: cve@gitlab.com
tags:
  - nvd
ingestedAt: '2026-08-29T00:27:52.434Z'
epss: 0.00242
epssPercentile: 0.15337
---

## Overview

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

## Affected

- `gitlab >= 18.3.0, < 19.1.7`
- `gitlab >= 19.2.0, < 19.2.5`
- `gitlab = 19.3.0`

## Remediation

Upgrade past the affected range:

- `gitlab 19.2.5`