What is the CVSS score of CVE-2026-15077?

CVE-2026-15077 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-15077?

Yes, a patch is available for CVE-2026-15077. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-15077

EUVD-2026-50478 MEDIUM

Improper Neutralization of Input Used for LLM Prompting (CWE-1427)

2026-07-29 GitLab

GHSA-349h-ggfr-h55v

Gitlab Authentication Bypass

4.3

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible via standard GitLab web interface; PR:L required as any authenticated user can submit merge requests; C:L only since cross-project disclosure is limited and scoped.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 20:02 vuln.today

Patch available

Jul 29, 2026 - 20:02 EUVD

CVE Published

Jul 29, 2026 - 19:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.

AnalysisAI

Information disclosure in GitLab Enterprise Edition's AI-assisted code review feature allows authenticated users to access data from projects they are not authorized to view. Affected versions are 19.1.x before 19.1.3 and 19.2.x before 19.2.1. An attacker with any level of authenticated access can craft malicious code content that, when processed by the AI review engine, causes the model to return information from unauthorized projects - a classic prompt injection boundary-crossing attack. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

GitLab EE's AI-assisted code review functionality ingests developer-supplied code from merge requests and passes it to an AI/ML inference layer for analysis. CWE-1427 - Improper Neutralization of Input Used in an AI/ML System - identifies the root cause: the system fails to adequately sanitize or isolate untrusted content before it influences the AI model's inference context. This is the architectural class of vulnerability commonly called 'prompt injection,' where adversarially crafted input manipulates the model into bypassing intended operating boundaries - in this case, the per-project authorization scope. Because the AI layer may aggregate cross-project context for richer analysis (a common design in enterprise AI code review tools), improperly neutralized content can redirect model output toward data from projects the requesting user lacks permission to access. The CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* scopes this to GitLab application instances rather than self-managed infrastructure components.

RemediationAI

Upgrade GitLab EE to version 19.1.3 (for instances on the 19.1 branch) or 19.2.1 (for instances on the 19.2 branch) - these are the vendor-confirmed patched releases per the GitLab patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/. If immediate upgrade is not feasible, disabling the AI-assisted code review feature in GitLab EE eliminates the attack surface entirely; this can be done via the instance-level or group-level AI feature settings. The trade-off is loss of AI review functionality until patching is complete. Restricting which projects or groups have AI code review enabled can scope exposure to projects with fully trusted contributors, reducing but not eliminating risk. No workaround addresses the underlying improper neutralization - disabling the feature is the only meaningful compensating control.