What is the CVSS score of CVE-2026-5952?

CVE-2026-5952 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-5952?

Yes, a patch is available for CVE-2026-5952. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-5952

EUVD-2026-39173 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-25 cve@gitlab.com

GHSA-8vj4-48p6-q87m

Authentication Bypass Gitlab

4.3

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Developer-role authentication required (PR:L); only Maven metadata integrity affected (I:L); no confidentiality or availability impact; scope unchanged as exploitation is confined to the GitLab instance.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:35 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite protected Maven package metadata due to incorrect authorization checks.

AnalysisAI

Incorrect authorization in GitLab CE/EE allows authenticated users holding developer-role permissions to bypass Maven package protection rules and overwrite protected package metadata. All GitLab versions from 17.11 through 18.11.5, 19.0.0 through 19.0.2, and 19.1.0 are affected, with patched releases available across all three trains. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world impact is scoped to organizations that have explicitly configured Maven package protection rules and host untrusted developer-role users.

Technical ContextAI

GitLab CE/EE provides a built-in package registry supporting multiple formats including Maven, with package protection rules that administrators configure to prevent unauthorized modification of published package artifacts and metadata (e.g., maven-metadata.xml version descriptors). CWE-863 (Incorrect Authorization) identifies the root cause: the authorization evaluation logic governing write operations to protected Maven package metadata fails to correctly enforce the protection rules when the requester holds a developer-role membership. This is a logic flaw in the access-control layer of the package registry subsystem - not an authentication bypass - meaning valid credentials are used but the permission boundary is incorrectly evaluated. The CVSS vector AV:N/AC:L/PR:L reflects that the flaw is exploitable over the network by any project member with at least developer-level access, with no elevated complexity or configuration ambiguity required on the attacker's side beyond holding that role.

RemediationAI

The primary fix is to upgrade GitLab CE/EE to one of the three patched releases: 18.11.6, 19.0.3, or 19.1.1, as detailed in the GitLab patch release notes at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. Organizations that cannot immediately patch should audit developer-role membership in all projects and groups that rely on Maven package protection rules, and consider temporarily demoting or removing developer access for accounts not requiring package publish rights - noting that this may disrupt CI/CD pipelines that authenticate at the developer tier. Disabling Maven package protection rules entirely is not recommended as a workaround because it removes the supply-chain integrity control rather than compensating for the bypass. No additional vendor-published mitigations were identified in the available references.