What is the CVSS score of CVE-2026-6976?

CVE-2026-6976 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-6976?

Yes, a public proof-of-concept exploit is available for CVE-2026-6976. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-6976?

Yes, a patch is available for CVE-2026-6976. Update the affected software to the latest version immediately.

GitLab CVE-2026-6976

EUVD-2026-36228 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-11 GitLab

GHSA-7mq5-3vcf-v96v

Gitlab Authentication Bypass

3.7

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

3.7 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

3.7 LOW

Developer-role authentication (PR:L), specific undisclosed file-naming conditions (AC:H), and passive reviewer interaction (UI:R) are all required; integrity impact from hidden code changes (I:L) with no availability effect.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 13:01 EUVD

Analysis Generated

Jun 11, 2026 - 11:56 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to hide changes from merge request diff views due to improper input handling of file names.

AnalysisAI

Merge request diff manipulation in GitLab CE/EE allows authenticated users with developer-role permissions to hide file changes from code reviewers by exploiting improper input handling of file names, undermining the integrity of the code review process. Publicly available exploit code exists via HackerOne report #3638136 (tagged 'exploit' in vendor references), though no confirmed active exploitation has been recorded in CISA KEV. The vulnerability spans a broad version range from 15.9 through the patched releases, meaning self-managed GitLab deployments without current patch levels are at risk from malicious insiders or compromised developer accounts bypassing review gates.

Technical ContextAI

GitLab CE/EE's merge request diff rendering engine uses file names as keys to build and present change views to code reviewers. CWE-639 (Authorization Bypass Through User-Controlled Key) describes exactly this failure mode: user-supplied input - here, file names crafted by the committing developer - is consumed without sufficient sanitization or validation, allowing that user to influence what data is surfaced in the authorization-adjacent diff display. The affected CPE (cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*) covers both Community Edition and Enterprise Edition deployments. The flaw persisting from version 15.9 onward suggests the vulnerable file-name handling logic has been present across many release cycles. The attack surface is GitLab's diff view pipeline, which transforms raw Git tree data into a human-readable reviewer interface - a layer that sits between the repository and the human code review gate.

RemediationAI

Upgrade self-managed GitLab CE/EE instances to 18.10.8, 18.11.5, or 19.0.2 as documented in the vendor patch release at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. GitLab.com deployments were patched by the vendor and require no customer action. For self-managed instances unable to patch immediately, the most actionable compensating control is to audit and restrict developer-role membership to verified, trusted personnel only - reducing the pool of accounts that could stage this attack. Requiring mandatory secondary or senior-reviewer approval before merge (configured via GitLab's protected branch rules and approval policies) adds a second human check that partially mitigates the risk of one reviewer being deceived. Note that these controls do not eliminate the vulnerability and carry the trade-off of increased review friction. Monitoring merge requests for anomalous or unusual file-naming patterns (e.g., files with control characters, homoglyphs, or non-standard Unicode) may surface exploitation attempts but is operationally intensive and not a reliable substitute for patching.