CVE-2026-1752

CVE-2026-1752 is an authorization bypass vulnerability in GitLab Enterprise Edition affecting versions 11.3 through 18.10.2 that allows authenticated developers to modify protected environment settings through improper API authorization checks. The vulnerability impacts multiple release lines including 18.8 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. The vulnerability has a CVSS score of 4.3 (Medium severity) with network-based attack vector, low complexity, and low privilege requirements. The impact is limited to integrity compromise with no confidentiality or availability impact, indicating an attacker could modify protected environment configurations but cannot access sensitive data or cause service disruption. There is currently no evidence of active exploitation in the wild. The vulnerability is not tracked in the Known Exploited Vulnerabilities catalog, has extremely low EPSS probability of exploitation (0.0001), and remains inactive on public exploit lists. However, organizations running affected GitLab EE versions should apply available patches to maintain proper access controls over environment protections.