What is the CVSS score of CVE-2026-4363?

CVE-2026-4363 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gitlab are affected by CVE-2026-4363?

CVE-2026-4363 is a low-severity vulnerability in GitLab EE affecting all (CVSS 3.7).. A patch is available.

How to fix or mitigate CVE-2026-4363?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Gitlab CVE-2026-4363

EUVD-2026-15481 LOW

Incorrect Authorization (CWE-863)

2026-03-25 GitLab

GHSA-c3cq-wgrq-qm9r

Gitlab Authentication Bypass

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 15:16 euvd

EUVD-2026-15481

Analysis Generated

Mar 25, 2026 - 15:16 vuln.today

CVE Published

Mar 25, 2026 - 15:04 nvd

LOW 3.7

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.

AnalysisAI

GitLab EE versions 18.1 through 18.8.6, 18.9.0 through 18.9.2, and 18.10.0 suffer from improper caching of authorization decisions that allows authenticated users to gain unauthorized access to resources under certain conditions. The vulnerability requires user interaction and has relatively high attack complexity, but impacts confidentiality and integrity of accessed resources. No public evidence of active exploitation or proof-of-concept code is currently documented.

Technical ContextAI

The vulnerability stems from CWE-863 (Incorrect Authorization), specifically involving authorization decision caching mechanisms in GitLab EE. When GitLab caches authorization decisions to optimize performance, the cache invalidation logic fails under certain conditions to properly reflect permission changes or context-specific access controls. This affects the GitLab application (cpe:2.3:a:gitlab:gitlab) across multiple minor versions in the 18.x release line. An authenticated user exploiting this flaw can bypass intended access controls by leveraging stale cached authorization states, allowing them to access resources they should not have permission to view or modify.

RemediationAI

Immediately upgrade GitLab EE to patched versions: 18.8.7 or later for the 18.8 line, 18.9.3 or later for the 18.9 line, or 18.10.1 or later for the 18.10 line. Refer to the official GitLab patch release documentation at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ for upgrade procedures. As an interim mitigation for organizations unable to patch immediately, enforce stricter access controls at the network level by restricting GitLab access to trusted IP ranges and disable public API access if not required. Additionally, audit authorization logs to detect suspicious access patterns from authenticated users to resources they should not access. Monitor for repeated 403 (Forbidden) errors followed by successful access, which may indicate exploitation attempts.