What is the CVSS score of CVE-2026-5173?

CVE-2026-5173 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gitlab are affected by CVE-2026-5173?

GitLab CE/EE versions 16.9.6 through 18.10.2 contain an improper access control vulnerability that allows authenticated users to invoke unauthorized server-side operations via websocket connections,…. A patch is available.

How to fix or mitigate CVE-2026-5173?

Within 24 hours: Identify all GitLab instances running versions 16.9.6-18.10.2 and verify current installed version. Within 7 days: Apply vendor-released patch to upgrade GitLab CE/EE to version 18.10.3 or later, or 16.11.x (earliest patched stable branch). Within 30 days: Audit websocket connection logs for unauthorized method invocations and review low-privilege user access patterns across projects to detect potential exploitation.

Gitlab CVE-2026-5173

EUVD-2026-20802 HIGH

Exposed Dangerous Method or Function (CWE-749)

2026-04-08 cve@gitlab.com

GHSA-5gj7-3j23-w2h2

Information Disclosure Gitlab

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 16:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:00 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

18.9.5,18.8.9,18.10.3

EUVD ID Assigned

Apr 08, 2026 - 23:24 euvd

EUVD-2026-20802

Analysis Generated

Apr 08, 2026 - 23:24 vuln.today

CVE Published

Apr 08, 2026 - 23:17 nvd

HIGH 8.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

AnalysisAI

Improper access control in GitLab CE/EE 16.9.6-18.10.2 enables authenticated attackers to invoke unauthorized server-side methods via websocket connections, achieving high-severity information disclosure with changed scope. Affects continuous integration/deployment platforms running vulnerable GitLab instances. Exploitation requires low-privilege authentication but no user interaction, enabling lateral information access across security boundaries.

Technical ContextAI

CWE-749 (Exposed Dangerous Method/Function) vulnerability in websocket handler. Authenticated users can invoke privileged server-side methods through improperly controlled websocket channels. CVSS scope change (S:C) indicates trust boundary violation, allowing attackers to access resources beyond their authorization level. Low attack complexity suggests straightforward exploitation pattern.

RemediationAI

Vendor-released patches: upgrade to GitLab 18.10.3, 18.9.5, or 18.8.9 depending on deployment branch. Patched versions enforce proper access control on websocket method invocations. No workarounds identified; upgrade is required mitigation. Official security advisory with technical details: https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/. Organizations unable to patch immediately should restrict authenticated user access and monitor websocket connection logs for anomalous server-side method calls. Prioritize upgrade for internet-facing GitLab instances due to network attack vector and authentication as only barrier.