What is the CVSS score of CVE-2026-4524?

CVE-2026-4524 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4524?

Yes, a patch is available for CVE-2026-4524. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-4524

EUVD-2026-30229 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-05-14 cve@gitlab.com

GHSA-95pv-g7fc-7pxj

Information Disclosure Gitlab

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:50 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.

AnalysisAI

Improper authorization in GitLab CE/EE exposes confidential issue content to any authenticated user on public projects across three active release branches. The flaw (CWE-288) allows a low-privileged, authenticated user - including users with no project membership - to read issue content that project owners explicitly marked confidential and restricted. With patch versions released on May 13, 2026 and no public exploit or KEV listing identified at time of analysis, the immediate threat is bounded, though the confidentiality impact is rated High by CVSS given the potential for sensitive business or security-relevant issue data to be disclosed.

Technical ContextAI

GitLab's issue tracker supports a 'confidential' flag on issues within public projects, intended to restrict visibility to project members and above while keeping the project itself publicly accessible. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates that an alternate code path or API endpoint in GitLab's authorization layer fails to enforce the confidential-issue visibility check, allowing the restriction to be bypassed by any authenticated session. Affected products are identified by CPE as both GitLab Community Edition and Enterprise Edition (cpe:2.3:a:gitlab:gitlab). The vulnerability spans the 18.9, 18.10, and 18.11 release trains, suggesting the defect was introduced or carried forward during that development window and was not caught by authorization unit tests across those branches.

RemediationAI

Upgrade to the vendor-patched releases: GitLab 18.9.7, 18.10.6, or 18.11.3, all made available via the May 13, 2026 patch release at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. GitLab.com hosted instances were patched automatically; self-managed administrators must apply the update manually. As a compensating control prior to patching, organizations can convert sensitive confidential issues into private projects rather than public ones, since the vulnerability specifically requires the project to be publicly accessible - this eliminates the attack surface entirely but sacrifices public project visibility. Alternatively, reviewing and temporarily removing confidential-issue content from public projects that contain genuinely sensitive data reduces exposure risk without requiring downtime. No side-effect concerns are documented for the patch itself.