What is the CVSS score of CVE-2026-9807?

CVE-2026-9807 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-9807?

Yes, a public proof-of-concept exploit is available for CVE-2026-9807. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-9807?

Yes, a patch is available for CVE-2026-9807. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-9807

EUVD-2026-32742 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-28 GitLab

GHSA-77hj-c554-4343

Gitlab Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 10:01 EUVD

Analysis Generated

May 28, 2026 - 09:20 vuln.today

CVE Published

May 28, 2026 - 07:34 nvd

MEDIUM 4.3

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked Project Access Token to continue accessing private resources due to incorrect authorization enforcement.

AnalysisAI

Incorrect authorization enforcement in GitLab CE/EE permits a blocked Project Access Token to continue reading private project resources despite administrative revocation. Affected are all GitLab CE/EE instances running versions 18.9 through 18.10.6, 18.11 through 18.11.3, and 19.0.0 - patched versions 18.10.7, 18.11.4, and 19.0.1 were released 2026-05-27. A publicly available exploit exists via HackerOne report #3554993, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

GitLab CE/EE (CPE: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*) uses Project Access Tokens as machine-user credentials scoped to individual projects, commonly used in CI/CD pipelines and automation. When an administrator blocks a token, the platform is expected to enforce that revocation on every subsequent request. CWE-863 (Incorrect Authorization) describes exactly this failure class: the system performs some authorization check but implements it incorrectly, allowing an access control decision that should deny to inadvertently permit. The flaw is not that no check exists, but that under unspecified conditions the check does not correctly evaluate the blocked state of the token, allowing the token bearer to read private project data over the network using the GitLab API.

RemediationAI

Upgrade to GitLab CE/EE version 18.10.7, 18.11.4, or 19.0.1 as appropriate for your release branch - these patched versions were released on 2026-05-27 per the GitLab advisory at https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/. If an immediate upgrade is not feasible, consider auditing all recently blocked Project Access Tokens and rotating any secrets or credentials those tokens had access to, treating blocked-but-potentially-still-active tokens as compromised. As a compensating control, temporarily revoking all Project Access Tokens (not just blocking them) eliminates the exposure surface at the cost of disrupting dependent automation. Restricting private project access to IP allowlists at the network layer limits exploitation to attackers already on permitted network ranges. The GitLab work item tracking this fix is at https://gitlab.com/gitlab-org/gitlab/-/work_items/590694.