What is the CVSS score of CVE-2026-5796?

CVE-2026-5796 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-5796?

Yes, a patch is available for CVE-2026-5796. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-5796

EUVD-2026-39174 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-25 cve@gitlab.com

GHSA-v93g-p6q6-9wwq

Authentication Bypass Gitlab

4.3

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Reporter-level group membership is required (PR:L); only package metadata is exposed with no integrity or availability impact, so C:L and I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:34 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from projects with the Package Registry disabled due to incorrect authorization checks in the group packages feature.

AnalysisAI

Incorrect authorization in GitLab CE/EE's group packages feature exposes package metadata from projects where the Package Registry has been explicitly disabled, allowing any authenticated Reporter-level group member to enumerate package names, versions, and publish timestamps that project owners intended to restrict. The flaw spans a very wide version range - all 13.6+ releases up to the newly-issued fixes in 18.11.6, 19.0.3, and 19.1.1 - meaning a large proportion of self-hosted GitLab deployments are affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

GitLab's Package Registry enables projects to host software packages (npm, Maven, PyPI, Conan, etc.). A group-level aggregation feature collects and presents package listings across all member projects. CWE-863 (Incorrect Authorization) identifies the root cause: the authorization logic governing the group-level packages endpoint failed to cross-check whether each member project had its Package Registry feature disabled, instead relying only on the caller's group-level role. This means the access-control enforcement was applied at the wrong granularity - group membership was verified, but per-project feature flags were not consulted. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms this is a straightforward network-reachable check that requires no special conditions beyond holding a Reporter role in the group. No CPE strings were provided in the source data, but the vendor advisory confirms the affected codebase is gitlab-org/gitlab.

RemediationAI

Upgrade GitLab CE/EE to a patched release: 18.11.6 for deployments on the 18.x branch, 19.0.3 for the 19.0 branch, or 19.1.1 for the 19.1 branch, as documented in the patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. No explicit workarounds are documented in the available references. As a compensating control pending upgrade, administrators may audit and reduce group memberships to limit which users hold Reporter-level (or higher) access in sensitive groups - however, this does not eliminate the authorization flaw and may disrupt legitimate collaboration workflows. GitLab.com hosted instances do not require customer action.