What is the CVSS score of CVE-2026-6269?

CVE-2026-6269 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6269?

Yes, a public proof-of-concept exploit is available for CVE-2026-6269. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-6269?

Yes, a patch is available for CVE-2026-6269. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-6269

EUVD-2026-36231 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-11 GitLab

GHSA-c3j7-m5hr-8w75

Gitlab Authentication Bypass

5.4

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Developer-role authentication required (PR:L); network-accessible GitLab interface (AV:N); limited read/write impact on hidden MRs only, no availability or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 13:01 EUVD

Analysis Generated

Jun 11, 2026 - 11:56 vuln.today

CVE Published

Jun 11, 2026 - 10:20 cve.org

MEDIUM 5.4

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to modify hidden merge requests due to incorrect authorization enforcements.

AnalysisAI

Incorrect authorization enforcement in GitLab CE/EE exposes hidden merge requests to unauthorized modification by authenticated users holding developer-role permissions. The flaw spans a wide version range - from 15.10 through the patched releases 18.10.8, 18.11.5, and 19.0.2 - meaning a large proportion of self-managed GitLab deployments are potentially affected. A publicly available proof-of-concept exists via a disclosed HackerOne report, raising the practical exploitation risk beyond what the medium CVSS score alone suggests; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

GitLab CE/EE (CPE: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*) implements role-based access controls across projects, where the developer role confers code contribution rights but is not supposed to grant visibility or write access to hidden merge requests. The root cause is classified as CWE-863 (Incorrect Authorization): an authorization enforcement gap in the merge request modification pathway failed to validate whether the target merge request carried a hidden status before permitting the write operation. This is distinct from authentication bypass - the user is correctly authenticated and holds a legitimate role, but the per-resource authorization check is insufficiently granular, allowing the developer role to act on objects that should be invisible and immutable to it.

RemediationAI

The primary fix is to upgrade GitLab CE/EE to one of the patched releases: 18.10.8, 18.11.5, or 19.0.2, released on June 10, 2026, per the vendor advisory at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. Organizations unable to upgrade immediately should consider restricting the developer role assignment to trusted users only, auditing current developer-role memberships across projects that use hidden merge requests, and reviewing audit logs for unexpected modifications to confidential or hidden merge requests. Restricting developer role grants reduces the attack surface but carries the trade-off of impeding legitimate contribution workflows. There is no known configuration toggle to disable the vulnerable code path without upgrading. GitLab's internal work item tracking the fix is at https://gitlab.com/gitlab-org/gitlab/-/work_items/596625.