What is the CVSS score of CVE-2026-5296?

CVE-2026-5296 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5296?

Yes, a patch is available for CVE-2026-5296. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-5296

EUVD-2026-32619 MEDIUM

Missing Authorization (CWE-862)

2026-05-27 cve@gitlab.com

GHSA-rqc8-7v7g-9hfr

Gitlab Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:03 vuln.today

Patch available

May 27, 2026 - 20:04 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that when foundational flows were enabled at the group level, could have allowed an authenticated user with developer-role permissions to bypass flow restrictions under certain conditions.

AnalysisAI

Authorization bypass in GitLab Enterprise Edition allows authenticated users holding only developer-role permissions to circumvent flow restrictions when foundational flows are enabled at the group level. Affecting all EE versions from 18.7 through 19.0 (prior to the respective patch releases), this flaw stems from missing authorization checks (CWE-862) and results in a low-integrity-impact, network-accessible exploitation path. No active exploitation has been identified (SSVC: Exploitation none), and GitLab has released patches across all affected branches as of 2026-05-27.

Technical ContextAI

The vulnerability resides in GitLab Enterprise Edition's 'foundational flows' feature, a group-level workflow enforcement mechanism. When this feature is enabled, the application fails to properly enforce authorization checks for certain operations that should be restricted by flow rules, as categorized under CWE-862 (Missing Authorization). The affected CPE is cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*, confirming this issue is exclusive to the Enterprise Edition and does not affect GitLab Community Edition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over the network with low complexity, requiring only low-privilege (developer-role) authenticated access and no user interaction.

RemediationAI

GitLab has released patched versions addressing this vulnerability: upgrade to 18.10.7, 18.11.4, or 19.0.1 depending on the deployed branch. The official patch release advisory is at https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/ and the corresponding issue tracker entry is at https://gitlab.com/gitlab-org/gitlab/-/work_items/595423. If immediate upgrade is not feasible, a targeted compensating control is to disable the 'foundational flows' feature at the group level - this removes the vulnerable code path entirely but will also disable workflow enforcement functionality that groups may depend on. Organizations should assess the operational impact of disabling this feature before applying it as a workaround. No other workarounds are identified in available data.