What is the CVSS score of EUVD-2026-30221?

EUVD-2026-30221 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30221?

Yes, a patch is available for EUVD-2026-30221. Update the affected software to the latest version immediately.

GitLab EUVD-2026-30221

| CVE-2026-1338 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-14 cve@gitlab.com

GHSA-8h74-p4xx-m53m

Authentication Bypass Gitlab

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:20 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks.

AnalysisAI

Authenticated developers in GitLab CE/EE can bypass container registry tag protection policies and delete protected tags due to improper server-side authorization checks (CWE-639), affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. The vulnerability was privately disclosed via HackerOne (report 3480620) and remediated in the May 2026 patch release cycle. No public exploit identified at time of analysis, and an EPSS of 0.01% (1st percentile) combined with SSVC exploitation status of 'none' indicate minimal current real-world exploitation risk.

Technical ContextAI

GitLab's container registry supports tag protection rules intended to restrict which roles may delete or modify specific image tags - a control commonly used to enforce immutability on release or production artifacts. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a flaw class where the application relies on a user-supplied identifier to make authorization decisions without adequate server-side enforcement, a pattern closely related to Insecure Direct Object Reference (IDOR). In this case, the tag deletion endpoint fails to enforce the protected-tag policy when the request originates from a developer-role session, allowing the user to supply a protected tag's identifier and successfully delete it. Both GitLab Community Edition and Enterprise Edition are confirmed affected by CPE strings cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* and cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*, making this an across-the-board issue independent of licensing tier.

RemediationAI

Upgrade GitLab CE/EE to one of the three patched releases: 18.9.7, 18.10.6, or 18.11.3, as documented in the vendor advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. If an immediate upgrade is not feasible, a compensating control is to audit and reduce developer-role membership on projects that actively use protected container registry tags as a security boundary - limiting the population of users who could trigger the authorization bypass. Note that reducing developer-role access may break CI/CD pipeline jobs or automation that depends on developer-level permissions for registry operations, so pipeline service accounts should be reviewed before applying this workaround. Disabling the container registry entirely is not warranted given the narrow scope of the flaw.