What is the CVSS score of CVE-2026-3074?

CVE-2026-3074 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-3074?

Yes, a patch is available for CVE-2026-3074. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-3074

EUVD-2026-30225 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-14 cve@gitlab.com

GHSA-wx3h-gcg8-jh5r

Authentication Bypass Gitlab

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:21 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to download private debugging symbols from inaccessible projects due to improper access control.

AnalysisAI

Unauthorized debug symbol exposure in GitLab CE/EE allows access to private debugging artifacts from projects the requester should not be able to reach, due to improper authorization controls (CWE-639: Authorization Bypass Through User-Controlled Key). Affected instances span all GitLab CE and EE deployments running versions from 16.7 up through the patched releases 18.9.7, 18.10.6, and 18.11.3 - a broad version window of roughly two years of releases. No public exploit has been identified at time of analysis, EPSS is 0.02% (5th percentile), and CISA SSVC rates exploitation status as none, collectively indicating low near-term exploitation probability despite the wide version exposure.

Technical ContextAI

GitLab CE and EE (cpe:2.3:a:gitlab:gitlab) support upload and retrieval of debugging symbol packages as part of CI/CD and crash-reporting workflows - artifacts such as dSYM, PDB, or ELF symbol files that map binary addresses back to source code. CWE-639 (Authorization Bypass Through User-Controlled Key) indicates the download endpoint relies on a user-supplied identifier - likely a project ID, artifact path, or token - to locate the symbol file without performing a proper authorization check confirming that the requester holds at least Reporter-level access to that project. This IDOR-class flaw means the access control gate is bypassed by simply supplying a key that belongs to a project outside the requester's permitted scope. Both Community Edition and Enterprise Edition are affected across the same version range, confirming the vulnerable code path exists in the shared core codebase rather than an EE-exclusive feature.

RemediationAI

The primary fix is to upgrade to one of the patched releases: GitLab 18.11.3, 18.10.6, or 18.9.7, as detailed in the official patch release blog at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. Administrators running versions between 16.7 and 18.9.x on a branch earlier than 18.9.7 should upgrade directly to 18.9.7 or later. If an immediate upgrade is not feasible, a compensating control is to restrict network access to the debug symbols download endpoint at the reverse-proxy or WAF layer; the trade-off is that legitimate CI/CD consumers of debug symbols (e.g., Sentry, crash reporters) will also be blocked until the rule is scoped to known-good source IPs. Alternatively, disabling the symbol upload feature in project CI/CD settings removes the exploitable artifact entirely at the cost of losing crash-reporting symbolication. No workaround is confirmed by the vendor in the available references - these mitigations are inferred from the vulnerability class.