What is the CVSS score of CVE-2026-6352?

CVE-2026-6352 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-6352?

Yes, a patch is available for CVE-2026-6352. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-6352

EUVD-2026-42408 LOW

Incorrect Authorization (CWE-863)

2026-07-08 cve@gitlab.com

GHSA-7j3x-j5f8-qr4f

Authentication Bypass Gitlab

2.7

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

Network-accessible GraphQL endpoint, PR:H because auditor role is required, integrity-only impact limited to compliance records, no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 22:27 vuln.today

Patch available

Jul 08, 2026 - 22:04 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper authorization on certain GraphQL operations.

AnalysisAI

Improper authorization on GitLab EE GraphQL operations permits authenticated users holding auditor-level access to write modifications to compliance violation records - an action that role should not permit. Affected versions span all GitLab EE releases from 18.2 through the patched thresholds (18.11.7, 19.0.4, 19.1.2). No public exploit code exists and CISA KEV does not list this vulnerability; with CVSS 2.7 and PR:H, real-world impact is narrow but meaningful for organizations relying on compliance audit trails for regulatory evidence.

Technical ContextAI

GitLab EE exposes compliance management features - including violation records - via its GraphQL API. The root cause is CWE-863 (Incorrect Authorization): certain GraphQL mutation or query operations failed to enforce that the requesting principal holds a role with write permissions, accepting auditor-level tokens where only higher-privileged roles should succeed. Auditor roles in GitLab EE are explicitly designed as read-only observers for compliance workflows; the bypass undermines that trust boundary. Affected CPE scope covers GitLab EE versions 18.2.x through 18.11.6, 19.0.x through 19.0.3, and 19.1.x through 19.1.1 as reported by EUVD-2026-42408.

RemediationAI

Upgrade GitLab EE to a patched release: 18.11.7, 19.0.4, or 19.1.2 depending on the current release train in use. Patch details are published in the GitLab patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/. If immediate upgrade is not feasible, restrict auditor-level role assignments to only trusted internal personnel pending patching, since the exploitation prerequisite is an active auditor session. Additionally, review compliance violation records for unexpected modifications as a detection measure - GitLab EE audit logs should capture GraphQL mutations. No workaround that disables the affected GraphQL operations without broader feature degradation has been published.