What is the CVSS score of CVE-2026-8144?

CVE-2026-8144 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8144?

Yes, a patch is available for CVE-2026-8144. Update the affected software to the latest version immediately.

GitLab CVE-2026-8144

EUVD-2026-30241 MEDIUM

Missing Authorization (CWE-862)

2026-05-14 cve@gitlab.com

GHSA-c73g-r4cp-2xmg

Authentication Bypass Gitlab

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:09 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.

AnalysisAI

Private group member enumeration in GitLab CE/EE affects all versions from 15.1 through unfixed releases 18.9.6, 18.10.5, and 18.11.2, permitting any authenticated user holding project membership to discover the member list of an otherwise private group due to a missing authorization check (CWE-862). The flaw collapses GitLab's tiered permission boundary between project-level and group-level access, leaking organizational membership data to users who have no entitlement to view it. No public exploit has been identified at time of analysis, and an EPSS score of 0.01% (2nd percentile) reflects near-zero observed exploitation probability.

Technical ContextAI

GitLab CE and EE are self-hosted and SaaS Git repository platforms with a layered permission model in which group membership is a distinct access tier from project membership. CWE-862 (Missing Authorization) identifies the root cause: a code path returning private group membership data fails to enforce the policy check confirming the requester is entitled to view that resource. Specifically, a project member is not automatically entitled to enumerate the parent group's member list when that group is private, but the missing check allows this boundary to be crossed. CPE identifiers cpe:2.3:a:gitlab:gitlab covering both the Community Edition and Enterprise Edition across the affected version ranges are confirmed by NVD and EUVD-2026-30241, meaning the flaw is present in all deployment tiers including self-managed and GitLab.com-hosted instances.

RemediationAI

Upgrade to GitLab CE/EE version 18.9.7, 18.10.6, or 18.11.3 - vendor-released patches confirmed by the GitLab advisory published 2026-05-13 at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. Organizations unable to patch immediately should audit and tighten project membership rosters on projects linked to sensitive private groups, revoking access for external contributors or contractors who do not require it - this directly shrinks the set of accounts that can exploit the flaw, though it carries the operational trade-off of reducing collaboration access. Additionally, restricting the ability to add new project members on sensitive group-linked projects via GitLab's project settings reduces ongoing exposure. Note that neither workaround eliminates the vulnerability; patching to a fixed release is the only complete remediation.