What is the CVSS score of CVE-2026-1322?

CVE-2026-1322 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-1322?

Yes, a public proof-of-concept exploit is available for CVE-2026-1322. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-1322?

Yes, a patch is available for CVE-2026-1322. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-1322

EUVD-2026-30220 MEDIUM

Business Logic Errors (CWE-840)

2026-05-14 cve@gitlab.com

GHSA-27g3-rwx2-w54w

Information Disclosure Gitlab

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:26 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

CVE Published

May 14, 2026 - 06:16 nvd

MEDIUM 6.8

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

AnalysisAI

OAuth scope enforcement bypass in GitLab CE/EE allows an authenticated user holding a read_api-scoped OAuth token to perform unauthorized write operations - specifically creating issues and adding comments - in private projects. Affected are all GitLab Community and Enterprise Edition installations from version 16.0 up to the patched releases 18.9.7, 18.10.6, and 18.11.3. A publicly available proof-of-concept exists, and while EPSS probability is extremely low (0.01%, 1st percentile) with no CISA KEV listing, the integrity impact is rated High given the ability to inject content into private project issue trackers.

Technical ContextAI

GitLab's OAuth 2.0 implementation defines scopes that are intended to govern API access permissions; the read_api scope is documented as providing read-only access to the API. CWE-840 (Business Logic Errors) identifies the root cause: the authorization layer failed to enforce the read-only contract of the read_api scope when processing issue-creation and comment-addition API endpoints for private projects. CPE strings confirm both the Community (cpe:2.3:a:gitlab:gitlab:*:*:*:*:community) and Enterprise (cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise) editions are affected across a broad version range spanning from 16.0. The flaw sits at the intersection of OAuth scope validation and project-level authorization - a logic gap where scope-level enforcement was not consistently applied before resource-level write operations were permitted.

RemediationAI

Upgrade to one of the patched GitLab releases: 18.9.7, 18.10.6, or 18.11.3, published 2026-05-13 per the vendor advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. For organizations unable to patch immediately, a targeted compensating control is to audit and revoke existing OAuth applications that hold the read_api scope, particularly those registered by users who should not have write access to private projects - this eliminates the attack surface without requiring a maintenance window. Additionally, administrators can restrict OAuth application creation to trusted users only via GitLab's application settings, reducing the pool of potential abusers. Note that revoking existing OAuth tokens may break integrations that rely on read_api scope for legitimate read operations, so token inventory review is advised before revocation.