CVE-2026-4916
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In GitLab CE/EE from version 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an authenticated user with custom role permissions can demote or remove higher-privileged group members due to improper authorization checks.
Risk Assessment
Users with lower privileges can escalate their privileges by removing administrators, potentially leading to group takeover.
Recommendation
Update GitLab to version 18.8.9, 18.9.5, or 18.10.3 depending on the branch used.
Original NVD description (English source)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization checks on member management operations.