What is the CVSS score of CVE-2026-6267?

CVE-2026-6267 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of GitLab are affected by CVE-2026-6267?

A privilege escalation vulnerability in GitLab CE/EE (versions before 19.0.5, 19.1.3, and 19.2.1) allows authenticated developers to access confidential information beyond their designated…. A patch is available.

Is there a public PoC exploit available for CVE-2026-6267?

Yes, a public proof-of-concept exploit is available for CVE-2026-6267. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-6267?

Within 24 hours, inventory all GitLab instances and identify those running versions before 19.0.5, 19.1.3, or 19.2.1, then review access logs for suspicious developer activity and restrict developer access to sensitive projects where feasible. Within 7 days, assess business impact of potentially exposed repositories and secrets, coordinate upgrade planning with development teams prioritizing critical instances, and brief stakeholders on exposure window and remediation timeline. Within 30 days, execute GitLab upgrades to version 19.0.5, 19.1.3, 19.2.1, or later across all affected instances, beginning with production environments, and conduct post-patch audit of developer access patterns.

GitLab CVE-2026-6267

EUVD-2026-50484 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-29 GitLab

GHSA-6fhj-cgmm-xfx6

Authentication Bypass Gitlab

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (GitLab) PRIMARY

HIGH

qualitative

NVD

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.1 HIGH

Developer-role auth gives PR:L; 'under certain conditions' internal handling gives AC:H; scope change to other resources S:C; impact is primarily unauthorized information access (C:H), with limited integrity and no clear availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 14:07 NVD

HIGH MEDIUM

CVSS changed

Aug 03, 2026 - 14:07 NVD

8.5 (HIGH) 5.3 (MEDIUM)

Patch available

Jul 29, 2026 - 20:02 EUVD

Analysis Generated

Jul 29, 2026 - 19:50 vuln.today

CVE Published

Jul 29, 2026 - 19:01 cve.org

HIGH 8.5

DescriptionNVD

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.

Articles & Coverage 2

News 3 New GitLab Vulnerabilities - 3 High Severity, 2 With POC Jul 30, 2026 News 3 New GitLab Vulnerabilities - 3 High Severity, 2 With POC Jul 29, 2026

AnalysisAI

Information disclosure in GitLab CE/EE (all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an authenticated user holding only the Developer role to reach unauthorized information because internal request handling enforces insufficient access controls (CWE-201). Publicly available exploit code exists (referenced HackerOne report #3658324), but there is no public exploit identified as being used in active attacks. With a CVSS of 8.5 driven by a scope-changing confidentiality impact, this is a meaningful privilege/authorization boundary failure rather than a full remote code execution flaw.

Technical ContextAI

GitLab is a self-managed and SaaS DevOps platform combining Git repository hosting, CI/CD, issue tracking, and container registry services, running as a Rails application that brokers many privileged operations through internal service-to-service and API request paths. The CWE-201 (Insertion of Sensitive Information Into Sent Data) root cause here maps to GitLab's internal request handling emitting or exposing data that should be gated behind higher authorization than the Developer role. The single generic CPE (cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*) confirms the flaw spans the core GitLab product line (both Community and Enterprise editions) rather than a specific add-on, and the vendor's version ranges indicate a long-lived defect present since 10.1.0. The 'Authentication Bypass' tag is somewhat imprecise: this is an authorization/access-control gap for an already-authenticated Developer-role account, not an unauthenticated bypass.

RemediationAI

Vendor-released patch: upgrade to GitLab 19.0.5, 19.1.3, or 19.2.1 (or later) depending on your current major/minor branch, as documented at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/; self-managed operators should apply the corresponding patch release for their branch immediately. Because exploitation requires an authenticated Developer-role account, an effective interim compensating control is to audit and minimize Developer-role membership, removing or downgrading untrusted or unnecessary accounts and enforcing that only vetted users hold Developer or higher on sensitive projects - the trade-off is disrupted developer workflow and added administrative overhead. Additionally restrict network reachability of the GitLab instance to trusted users/VPN where feasible to shrink the pool of authenticated actors, accepting reduced accessibility as the cost. No feature-level toggle is documented to disable the affected internal request handling, so patching remains the only complete fix; treat access-scoping as temporary until the upgrade is applied.