EUVD-2026-36230
GHSA-hm74-p2xf-rqgc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible instance, low-privilege authenticated role required (PR:L), limited integrity-only impact on security configuration with no confidentiality or availability effect.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage project security configuration even when the relevant feature was in a disabled state, due to incorrect authorization enforcement.
AnalysisAI
Incorrect authorization enforcement in GitLab Enterprise Edition allows an authenticated user holding the Security Manager role to manage project security configurations even when the relevant security feature has been administratively disabled. Affecting all EE versions from 13.9 through the patched releases (18.10.8, 18.11.5, 19.0.2), the flaw bypasses the feature-disabled gate by failing to validate feature state alongside role-based permissions. No public exploit is confirmed as actively exploited (not in CISA KEV), though a publicly available HackerOne exploit report exists, and EPSS data was not provided in available intelligence.
Technical ContextAI
GitLab Enterprise Edition implements a role-based access control system that includes an EE-exclusive Security Manager role, which governs who can configure project-level security policies and settings. CWE-863 (Incorrect Authorization) identifies the root cause: the authorization logic verified that the requesting user held the Security Manager role but failed to additionally assert that the controlled feature was in an enabled state, creating an authorization bypass path. The CPE string cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* covers the broad version range from 13.9 onward. The flaw is specific to GitLab EE since the Security Manager role does not exist in the Community Edition, which narrows the affected surface to paid enterprise deployments.
RemediationAI
Upgrade GitLab EE to one of the patched releases: 18.10.8, 18.11.5, or 19.0.2, as documented in the vendor patch advisory at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. If immediate patching is not feasible, administrators should audit and restrict Security Manager role assignments to only explicitly trusted personnel, since the attack surface is gated entirely by holding that role. Temporarily revoking the Security Manager role from accounts that do not strictly require it reduces exposure with no service disruption; the trade-off is reduced operational capability for teams relying on that role for legitimate security management tasks. No configuration-level workaround that patches the underlying authorization logic without a code update has been documented.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today