What is the CVSS score of CVE-2026-3553?

CVE-2026-3553 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-3553?

Yes, a public proof-of-concept exploit is available for CVE-2026-3553. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-3553?

Yes, a patch is available for CVE-2026-3553. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-3553

EUVD-2026-36232 LOW

Incorrect Authorization (CWE-863)

2026-06-11 GitLab

GHSA-h8wc-8hmg-pcc9

Gitlab Authentication Bypass

3.1

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network-reachable flaw requiring low-privilege auth and specific undisclosed conditions; only confidential issue text is exposed with no integrity or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 13:01 EUVD

Analysis Generated

Jun 11, 2026 - 11:58 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to access confidential issue details due to incorrect authorization checks.

AnalysisAI

Incorrect authorization checks in GitLab CE/EE expose confidential issue details to authenticated low-privileged users under specific conditions. The flaw spans an enormous version range starting from 12.0, meaning a large population of self-hosted GitLab instances running unpatched versions is potentially affected. A publicly available exploit was disclosed via HackerOne (report #3578216), which elevates practical risk above what the low CVSS score of 3.1 alone suggests, even though active exploitation has not been confirmed by CISA KEV.

Technical ContextAI

GitLab's issue tracker supports a 'confidential issues' feature that restricts visibility to project members with at minimum a Reporter role, preventing Guests and non-members from viewing sensitive issue content. CWE-863 (Incorrect Authorization) indicates the authorization logic is present but implemented incorrectly - the system performs a check but under certain conditions reaches an incorrect authorization decision, permitting access that should be denied. The CPE string cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* applies broadly to both Community Edition and Enterprise Edition across all platforms and deployment modes. The CVSS AC:H metric indicates that exploitation is not trivially repeatable and requires specific preconditions to be met, though the exact triggering configuration is not fully disclosed in public data.

RemediationAI

Vendor-released patches are available: upgrade to GitLab 18.10.8, 18.11.5, or 19.0.2 depending on your current release stream. The official patch advisory is at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. If immediate patching is not feasible, organizations should audit project membership and remove Guest-level or untrusted users from projects containing confidential issues as a compensating control - note this may disrupt collaboration workflows. Additionally, consider enabling GitLab's audit log feature to detect unauthorized access to confidential issue content. For GitLab.com (SaaS), GitLab has already applied the fix and no user action is required.