What is the CVSS score of CVE-2026-6336?

CVE-2026-6336 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-6336?

Yes, a public proof-of-concept exploit is available for CVE-2026-6336. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-6336?

Yes, a patch is available for CVE-2026-6336. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-6336

EUVD-2026-50483 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-29 GitLab

GHSA-g9g2-qc64-jgcj

Authentication Bypass Gitlab

5.3

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no interaction needed; impact is limited to low confidentiality disclosure of import metadata only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 29, 2026 - 20:02 EUVD

Analysis Generated

Jul 29, 2026 - 19:51 vuln.today

CVE Published

Jul 29, 2026 - 19:01 cve.org

MEDIUM 5.3

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.

AnalysisAI

Unauthorized disclosure of project import source information in GitLab CE/EE stems from a missing authorization check (CWE-863), allowing unauthenticated remote users to view sensitive metadata about how a project was originally imported. All GitLab installations running versions from 16.6 up to 19.0.4, 19.1.2, and 19.2.0 are affected. A publicly available exploit exists via a disclosed HackerOne report, though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

GitLab CE and EE (CPE: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*) expose project import workflows that record metadata about import origins - such as the source repository URL or platform - during project creation. CWE-863 (Incorrect Authorization) identifies the root cause as an authorization decision point that was either absent or insufficiently enforced on the endpoint serving this import source data. The flaw is consistent with a server-side access control omission on a REST or GraphQL endpoint where the response was not gated against the caller's session or role. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the missing check is reachable without any authentication, making the exposure directly exploitable over the network by any party who can reach the GitLab instance.

RemediationAI

Upgrade to one of the vendor-released patched versions: GitLab 19.0.5, 19.1.3, or 19.2.1, as documented in the GitLab patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/. For GitLab instances that cannot be immediately upgraded, consider restricting public access to the GitLab instance at the network layer (firewall or reverse proxy authentication) to ensure only authenticated users can reach any GitLab endpoints - this compensates for the missing application-layer check but introduces friction for legitimate anonymous browsing features. Alternatively, disabling project import functionality (via Admin > Settings > General > Import sources) eliminates the attack surface entirely, with the trade-off that existing import workflows will be broken. GitLab.com (SaaS) has already been remediated by GitLab directly.