What is the CVSS score of CVE-2026-6713?

CVE-2026-6713 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6713?

Yes, a patch is available for CVE-2026-6713. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-6713

EUVD-2026-32618 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-27 cve@gitlab.com

GHSA-r38r-hvg8-xqhf

Gitlab Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:03 vuln.today

Patch available

May 27, 2026 - 20:04 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an unauthorized user to enumerate private projects due to incorrect authorization checks.

AnalysisAI

Unauthorized private project enumeration in GitLab CE/EE exposes confidential project metadata to unauthenticated network attackers due to incorrect authorization checks (CWE-863). All GitLab installations running versions from 18.2 through the patched releases are affected - both Community and Enterprise editions. While the direct impact is limited to information disclosure (project enumeration rather than content access), exposed project names and IDs can facilitate targeted follow-on attacks against otherwise hidden repositories. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The root cause is CWE-863 (Incorrect Authorization), where GitLab's authorization logic fails to correctly validate whether a requesting user has permission to discover the existence of private projects. This is distinct from authentication bypass - the system may correctly identify the user as unauthenticated, but incorrectly permits a project enumeration operation that should be gated on read access. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no special configuration, and no user interaction over the network. Affected products are confirmed via CPE as both GitLab Community Edition and Enterprise Edition (cpe:2.3:a:gitlab:gitlab:*:*:*:*:community and enterprise editions). The flaw was reported through HackerOne (report #3644605) and assigned ENISA EUVD-2026-32618, indicating coordinated disclosure.

RemediationAI

GitLab has released patched versions addressing this vulnerability. Administrators should upgrade to GitLab 18.10.7 (for 18.x installations on the 18.10 branch), 18.11.4 (for 18.11 branch), or 19.0.1 (for 19.0 branch) as the primary remediation. The vendor patch advisory is available at https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/. For organizations unable to patch immediately, compensating controls include restricting network access to the GitLab instance to authenticated network segments or VPN, which reduces exposure by removing the unauthenticated network attack vector - though this may impact legitimate external users. Enabling GitLab's 'Require sign-in to view profiles and projects' setting (Admin > Settings > General > Sign-in restrictions) may also reduce enumeration surface for unauthenticated users depending on which API endpoints are involved, though the exact triggering conditions for this CVE are not fully disclosed. No other workarounds are confirmed by vendor documentation.