What is the CVSS score of EUVD-2026-15803?

EUVD-2026-15803 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gitlab are affected by EUVD-2026-15803?

Organizations using GitLab CE/EE affecting all should be aware of moderate risk from CVE-2026-2726, a incorrect authorization vulnerability rated CVSS 4.3.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-15803?

Yes, a public proof-of-concept exploit is available for EUVD-2026-15803. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-15803?

Within 30 days: Identify affected systems running GitLab CE/EE affecting all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Gitlab EUVD-2026-15803

| CVE-2026-2726 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-25 GitLab

GHSA-4j77-rj27-2wxq

Gitlab Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

18.8.7,18.9.3,18.10.1

PoC Detected

Mar 26, 2026 - 18:30 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15803

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:34 nvd

MEDIUM 4.3

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due to improper access control during cross-repository operations.

AnalysisAI

GitLab CE/EE contains an improper access control vulnerability in cross-repository merge request operations that allows authenticated users to perform unauthorized actions on merge requests in projects they should not have access to. Affected versions span from 11.10 through 18.10.1, with patches available in 18.8.7, 18.9.3, and 18.10.1. A public proof-of-concept exploit exists (referenced via HackerOne report 3543886), though CISA has not listed this in the Known Exploited Vulnerabilities catalog, indicating limited active exploitation despite public availability of exploit code.

Technical ContextAI

The vulnerability stems from CWE-863 (Incorrect Authorization), a weakness in access control logic that fails to properly validate user permissions across repository boundaries during merge request operations. GitLab's merge request system implements cross-project operations (such as reviewing, approving, or modifying merge requests from linked projects), but the authorization checks do not adequately verify that the authenticated user has legitimate access to the target project before allowing modifications. This is a common pattern in distributed systems where privilege escalation occurs when authorization decisions are made based on incomplete context. The affected product is GitLab Community Edition and Enterprise Edition (CPE: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*), which implements collaborative version control and CI/CD orchestration. The attack requires network access and valid authentication credentials, making it relevant to organizations with multi-project GitLab deployments where users have varying permission levels across different projects.

RemediationAI

Immediately upgrade affected GitLab installations to patched versions: upgrade to GitLab 18.8.7 or later if on the 18.8 branch, GitLab 18.9.3 or later if on the 18.9 branch, or GitLab 18.10.1 or later if on the 18.10 branch. For instances on versions prior to 18.8, upgrade to at least 18.8.7. Consult https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ for detailed patch notes and upgrade procedures. Until patching is completed, implement compensating controls by restricting merge request modification permissions to project owners only, auditing cross-project merge request activity in GitLab audit logs, and disabling cross-project merge request features if not required for business operations. Review recent merge request activity and audit logs for unauthorized modifications across project boundaries to detect potential exploitation.