What is the CVSS score of CVE-2026-2238?

CVE-2026-2238 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-2238?

Yes, a patch is available for CVE-2026-2238. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-2238

EUVD-2026-39177 MEDIUM

Missing Authorization (CWE-862)

2026-06-25 cve@gitlab.com

GHSA-36ff-xw3f-vrx8

Authentication Bypass Gitlab

5.3

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint, no credentials required, low complexity; impact is partial confidentiality only - issue reference metadata - with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:33 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public projects due to improper authorization checks.

AnalysisAI

Confidential issue references in GitLab CE/EE public projects are exposed to unauthenticated users due to missing authorization checks (CWE-862). Affecting all GitLab versions from 17.5 through 18.11.5, 19.0.0-19.0.2, and 19.1.0, this flaw enables any unauthenticated remote attacker to retrieve references to confidential issues on public projects - potentially revealing issue IDs, titles, or internal metadata that project owners explicitly restricted. No public exploit code or CISA KEV listing exists at time of analysis; however, the unauthenticated, low-complexity network vector makes this trivially automatable for reconnaissance against large GitLab installations.

Technical ContextAI

GitLab's access control model distinguishes between public projects (world-readable) and confidential issues (restricted to project members and reporters). CWE-862 (Missing Authorization) indicates that the authorization gate controlling visibility of confidential issue references was not enforced under specific conditions - the endpoint or rendering path serving issue references on public projects failed to filter confidential items when the requestor is unauthenticated. This flaw exists in both the Community Edition (CE) and Enterprise Edition (EE) codebases, confirming it resides in shared core authorization logic rather than an EE-only feature. The CVSS vector AV:N/AC:L/PR:N/UI:N corroborates remote, unauthenticated, low-complexity exploitability. The HackerOne report (report 3543011) indicates responsible disclosure prior to vendor remediation.

RemediationAI

Upgrade GitLab CE/EE to one of the patched releases: 18.11.6, 19.0.3, or 19.1.1, as detailed in the vendor patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. For self-hosted instances unable to patch immediately, a targeted compensating control is to convert affected public projects to internal or private visibility - this eliminates the unauthenticated access surface entirely, though it reduces legitimate public discoverability of those projects. Alternatively, audit and temporarily remove or convert confidential issues on high-sensitivity public projects until patching is complete; note this may disrupt existing workflows. GitLab.com (the SaaS offering) is expected to have been patched by GitLab directly following the advisory release.