What is the CVSS score of EUVD-2026-30226?

EUVD-2026-30226 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30226?

Yes, a patch is available for EUVD-2026-30226. Update the affected software to the latest version immediately.

GitLab CE/EE EUVD-2026-30226

| CVE-2026-3160 MEDIUM

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-05-14 cve@gitlab.com

GHSA-255c-fxwg-6753

Information Disclosure Gitlab Atlassian

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:22 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.

AnalysisAI

GitLab's Jira integration exposes out-of-scope Jira issues to authenticated GitLab users across all editions (CE and EE) from version 13.7 through the patched releases, due to the integration's project-scope filter operating only as a UI display control rather than an enforced access boundary. The Changed scope (S:C) in the CVSS vector reflects that impact crosses into Atlassian Jira - a component outside GitLab's own trust domain - allowing confidential Jira issue data to leak beyond intended project boundaries. No public exploit exists and no active exploitation has been confirmed; EPSS is negligible at 0.01% (3rd percentile), placing this firmly in low-exploitation-probability territory despite a broad version range spanning over five years of releases.

Technical ContextAI

GitLab CE/EE (CPE: cpe:2.3:a:gitlab:gitlab) acts as a proxy between its own user access model and Atlassian Jira when the Jira integration is configured. The root cause is classified as CWE-441 (Unintended Proxy or Intermediary / Confused Deputy Problem): GitLab, acting as the intermediary, fetches Jira data on behalf of users but relies on a frontend display filter - rather than a backend access enforcement layer - to restrict which issues are shown per project scope. Because the filter never enforced an access boundary at the API or data-retrieval level, a user could observe or access Jira issues associated with projects outside the one configured for their GitLab integration. The CVSS Changed Scope (S:C) designation is appropriate here because the confidentiality impact (C:L) lands in Jira, not in GitLab itself. This affects both Community Edition and Enterprise Edition across a very wide version range (13.7 through 18.11.2).

RemediationAI

Upgrade to one of the following patched releases as appropriate for your current track: GitLab 18.11.3, GitLab 18.10.6, or GitLab 18.9.7. These versions enforce Jira project-scope access at the integration layer rather than as a display control only. The vendor advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/ provides upgrade instructions. As a compensating control for instances that cannot be immediately patched, administrators may disable the GitLab Jira integration entirely (Admin Area → Integrations → Jira) - note this will disrupt Jira issue linking and cross-referencing workflows for all projects. Restricting Jira integration configuration to trusted project owners and auditing which GitLab projects have Jira integrations enabled is a reasonable interim risk-reduction measure with minimal operational impact. Patch status is confirmed as available per GitLab advisory.