CVE-2026-14210 GitLab CVE debrief

Who should care

GitLab administrators and users with project-scoped fine-grained Personal Access Tokens should assess exposure and take necessary actions to protect their instances. This includes verifying instance versions, reviewing token usage, and monitoring for suspicious activity related to group-level labels. Security teams and vulnerability management teams should also review and prioritize remediation efforts.

Why it matters

Defenders should prioritize verifying exposure of GitLab instances to this vulnerability, especially those with project-scoped fine-grained Personal Access Tokens in use, to prevent potential unauthorized modification or deletion of group-level labels.

• Potential unauthorized modification or deletion of group-level labels
• Exposure of GitLab instances with project-scoped fine-grained Personal Access Tokens in use

Technical summary

The vulnerability affects GitLab CE/EE versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. An authenticated user with a project-scoped fine-grained Personal Access Token could potentially delete or modify group-level labels due to incorrect authorization logic. This issue was remediated by GitLab. Affected instances should apply patches and review usage of project-scoped fine-grained Personal Access Tokens. Defenders should prioritize verifying exposure of GitLab instances to this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of GitLab instances to this vulnerability, especially those with project-scoped fine-grained Personal Access Tokens in use.

Recommended defensive actions

• Verify GitLab instance versions and apply patches if necessary
• Review project-scoped fine-grained Personal Access Token usage and permissions
• Monitor for suspicious activity related to group-level labels
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and references to additional information. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The issue could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation. Evidence is limited to CVE,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.