CVE-2026-104661Medium· 4.3▾ SunlitGitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with co…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59563High· 8.8Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.
CVE-2026-108923Medium· 6.3A vulnerability was determined in 1024-lab smart-admin up to 3.30.0
CVE-2026-108899High· 7.3A flaw has been found in tobychui zoraxy up to 3.3.4
CVE-2026-32561High· 8.8Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.
CVE-2026-21756High· 7.2HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
CVE-2026-32558Critical· 9.8Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.