What is the CVSS score of CVE-2026-11379?

CVE-2026-11379 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-11379?

Yes, a patch is available for CVE-2026-11379. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-11379

EUVD-2026-39170 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-25 cve@gitlab.com

GHSA-9mc7-w3h9-cmmf

Authentication Bypass Gitlab

5.3

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible API (AV:N), undisclosed triggering conditions (AC:H), Developer role required (PR:L), secrets read-only with no integrity or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:32 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions.

AnalysisAI

Incorrect authorization in GitLab Enterprise Edition's DAST site profile management exposes stored secrets to users with the Developer role under certain conditions. Affecting all GitLab EE releases from 13.11 through the recently patched 18.11.6, 19.0.3, and 19.1.1, the flaw allows a lower-privileged authenticated user to read secrets - such as authentication credentials or API tokens - embedded in DAST site profiles they should not have access to. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) implies specific conditions must align for exploitation to succeed.

Technical ContextAI

GitLab EE's Dynamic Application Security Testing (DAST) feature allows teams to configure site profiles that store target URLs, authentication credentials, and other sensitive secrets used during automated security scans. These profiles are managed through GitLab's internal API and are intended to respect role-based access controls, where Developer-role users have limited visibility into sensitive configuration data. CWE-863 (Incorrect Authorization) indicates the authorization logic governing which role can read which fields in a DAST site profile is flawed - the checks do not correctly enforce the boundary between what a Developer may configure versus what secrets they may retrieve. This is distinct from a missing authentication control; the user is authenticated, but the post-authentication authorization decision is wrong, allowing privilege escalation within the DAST feature surface.

RemediationAI

Upgrade GitLab EE to version 18.11.6, 19.0.3, or 19.1.1, whichever applies to the currently deployed branch, as detailed in the patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. These are vendor-confirmed fixed versions. For organizations unable to patch immediately, a targeted compensating control is to audit and restrict Developer-role membership in projects that use DAST site profiles with stored secrets; reducing the number of users with Developer access limits the exposure window. Alternatively, rotate any credentials stored in DAST site profiles as a precautionary measure, particularly in projects with broad Developer membership. Note that restricting role membership may affect CI/CD pipeline contributors and should be coordinated with project teams to avoid disruption.