What is the CVSS score of CVE-2026-3176?

CVE-2026-3176 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-3176?

Yes, a patch is available for CVE-2026-3176. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-3176

EUVD-2026-39176 LOW

Missing Authorization (CWE-862)

2026-06-25 cve@gitlab.com

GHSA-3qr8-448j-gmpv

Authentication Bypass Gitlab

3.1

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network-accessible web app (AV:N); 'certain conditions' implies non-trivial prerequisites (AC:H); authenticated low-privilege user required (PR:L); read-only partial disclosure with no integrity or availability impact (C:L/I:N/A:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:34 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to access project information due to insufficient authorization checks.

AnalysisAI

Insufficient authorization checks in GitLab Enterprise Edition expose project information to authenticated users with limited permissions under specific, undisclosed conditions. Affecting all EE releases from 18.6 up to (but not including) 18.11.6, 19.0.3, and 19.1.1, this CWE-862 flaw allows a low-privileged authenticated attacker to read project data they should not have access to. No public exploit code exists and no active exploitation has been confirmed; the high attack complexity (AC:H) and requirement for an authenticated session substantially limit real-world risk.

Technical ContextAI

GitLab Enterprise Edition is a self-hosted and SaaS DevOps platform that enforces role-based access control (RBAC) over projects, groups, and repositories. The root cause is CWE-862 (Missing Authorization): a code path that retrieves or exposes project information does not perform the required permission check before returning data to the requester. The vulnerability manifests only 'under certain conditions,' indicating a conditional or edge-case branch in GitLab's authorization middleware rather than a wholesale bypass. The affected surface is the EE-specific tier (not CE/Community Edition), covering versions 18.6 through the fixed releases. The HackerOne report (hackerone.com/reports/3568164) is the originating disclosure; the GitLab work item gitlab.com/gitlab-org/gitlab/-/work_items/591373 tracks the internal remediation.

RemediationAI

Upgrade GitLab EE to one of the patched releases: 18.11.6, 19.0.3, or 19.1.1, as documented in the official patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. GitLab has confirmed these versions contain the remediation. If an immediate upgrade is not feasible, administrators should audit project visibility settings and restrict membership to projects containing sensitive data, reducing the pool of low-privileged users who could trigger the vulnerable code path. Additionally, reviewing GitLab audit logs for anomalous project access by users with Guest or Reporter roles may help detect any prior exploitation. No formal workaround bypassing the need to upgrade has been documented by the vendor.