What is the CVSS score of CVE-2026-5262?

CVE-2026-5262 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GitLab CE/EE are affected by CVE-2026-5262?

GitLab CE/EE versions 16.1.0-18.11.0 contain a cross-site scripting vulnerability in the Storybook environment that enables unauthenticated attackers to steal access tokens through social…. A patch is available.

Is there a public PoC exploit available for CVE-2026-5262?

Yes, a public proof-of-concept exploit is available for CVE-2026-5262. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5262?

Within 24 hours: Inventory all GitLab instances and confirm versions (affected ranges: 16.1.0-18.9.5, 18.10.0-18.10.3, 18.11.0). Within 7 days: Apply vendor-released patch to upgrade to GitLab 18.9.6, 18.10.4, 18.11.1 or later. Within 30 days: Audit GitLab access logs and token usage for the past 90 days; rotate all personal access tokens and deploy tokens as precautionary measure; review Storybook access controls and disable public access if not business-critical.

GitLab CE/EE CVE-2026-5262

EUVD-2026-25042 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 GitLab

GHSA-g9pv-f88j-p6rr

Gitlab XSS

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 20:54 vuln.today

cvss_changed

PoC Detected

Apr 23, 2026 - 20:38 vuln.today

Public exploit code

Patch released

Apr 23, 2026 - 20:38 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 00:16 vuln.today

Patch available

Apr 22, 2026 - 17:33 EUVD

EUVD ID Assigned

Apr 22, 2026 - 16:31 euvd

EUVD-2026-25042

Analysis Generated

Apr 22, 2026 - 16:31 vuln.today

CVE Published

Apr 22, 2026 - 16:04 nvd

HIGH 8.0

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.

AnalysisAI

Cross-site scripting vulnerability in GitLab's Storybook development environment allows remote unauthenticated attackers to steal access tokens via crafted user interaction. Affects GitLab CE/EE versions 16.1.0 through 18.9.5, 18.10 through 18.10.3, and 18.11.0. Publicly available exploit code exists (HackerOne report 3574642), though CISA SSVC indicates no confirmed active exploitation at time of analysis. CVSS 8.0 reflects high confidentiality and integrity impact with scope change, but CVSS vector AC:H (high complexity) and UI:R (user interaction required) indicate exploitation requires targeted social engineering rather than automated mass exploitation.

Technical ContextAI

This is an improper input validation vulnerability (CWE-79: Cross-site Scripting) affecting GitLab's Storybook development environment. Storybook is a frontend workshop tool used by developers to build and test UI components in isolation. The vulnerability stems from insufficient sanitization of user-controlled input within the Storybook interface, allowing injection of malicious JavaScript. When exploited, the XSS executes in the context of the GitLab domain with scope change (CVSS S:C), enabling access to authentication tokens that would normally be isolated from the Storybook environment. The CPE identifier cpe:2.3:a:gitlab:gitlab applies to both Community Edition (CE) and Enterprise Edition (EE) installations, indicating widespread applicability across GitLab's product line.

RemediationAI

Vendor-released patches are available: upgrade to GitLab 18.11.1, 18.10.4, or 18.9.6 depending on your current release branch. Organizations on the 16.x or 17.x series should upgrade to the latest patched version in the 18.x line. Full release details are documented at https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/. If immediate patching is not feasible, implement compensating controls: restrict network access to Storybook endpoints (typically /storybook/ paths) using firewall rules or reverse proxy ACLs to allow only trusted development networks (trade-off: may disrupt remote developer workflows); disable the Storybook feature entirely if not actively used in your development pipeline (consult GitLab documentation for feature flags); implement Content Security Policy headers to restrict script execution on GitLab domains (trade-off: requires testing to avoid breaking legitimate functionality). Monitor authentication logs for unusual token usage patterns originating from development environment IPs. GitLab's internal work item tracking the fix is available at https://gitlab.com/gitlab-org/gitlab/-/work_items/595332.