What is the CVSS score of CVE-2026-8716?

CVE-2026-8716 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8716?

Yes, a patch is available for CVE-2026-8716. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-8716

EUVD-2026-32617 MEDIUM

Use of Incorrectly-Resolved Name or Reference (CWE-706)

2026-05-27 cve@gitlab.com

GHSA-5p55-qcqv-882w

Gitlab Information Disclosure

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:03 vuln.today

Patch available

May 27, 2026 - 20:04 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to access CI data from a different ref type than intended.

AnalysisAI

Unauthorized CI data access in GitLab CE/EE allows an authenticated low-privileged user to read CI pipeline data from a ref type (branch, tag, or merge request ref) other than the one they are authorized to view, under certain unspecified conditions. All GitLab installations - both Community and Enterprise editions - running versions from 12.7 through the unpatched releases are affected. The vulnerability is classified as information disclosure with low confidentiality impact; no public exploit code has been identified at time of analysis and it is not listed in the CISA KEV catalog.

Technical ContextAI

GitLab's CI/CD subsystem scopes pipeline data - including job logs, artifacts, and potentially environment variable metadata - to specific Git ref types such as branches, tags, and merge request refs. CWE-706 (Use of Incorrectly-Resolved Name or Reference) describes the root cause: the application resolves a ref-type identifier incorrectly under certain conditions, causing authorization logic to evaluate access against the wrong ref context. The CPE data confirms both community and enterprise editions are affected across a wide version range (cpe:2.3:a:gitlab:gitlab). The breadth of affected versions - from 12.7 through current releases prior to the patch - suggests the flaw resides in long-standing ref-resolution logic within the CI data access layer rather than a recently introduced regression.

RemediationAI

Upgrade to one of the three patched versions released on 2026-05-27: GitLab 18.10.7, 18.11.4, or 19.0.1, depending on the currently deployed minor version. Full patch details are available in the vendor release announcement at https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/. For organizations that cannot immediately patch, a compensating control would be to audit and restrict CI/CD pipeline visibility settings at the project and group level - setting pipeline visibility to 'Only Project Members' reduces the exposure surface by limiting which authenticated users can interact with pipeline data endpoints. Note that this control does not eliminate the vulnerability but reduces the attacker pool. For self-managed instances, reviewing access logs for anomalous cross-ref CI data access patterns post-disclosure is advisable. GitLab.com (SaaS) users are protected by GitLab's own deployment of the patch.