EUVD-2026-30227
GHSA-jc2r-hgpx-4q9p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.
AnalysisAI
Package protection rule bypass in GitLab CE/EE allows authenticated users holding developer-role permissions to circumvent registry protections that should restrict their write or publish actions. Affecting all GitLab Community and Enterprise Edition instances running versions 18.3 through 18.9.6, 18.10 through 18.10.5, and 18.11 through 18.11.2, an attacker with a legitimately provisioned developer account can undermine the integrity controls placed on protected packages. No public exploit code exists and no active exploitation has been identified at time of analysis; the EPSS score of 0.01% (1st percentile) and SSVC exploitation rating of 'none' confirm this is a low-urgency finding.
Technical ContextAI
GitLab CE and EE expose a Package Registry feature that allows projects to host and distribute packages (e.g., npm, Maven, PyPI). Administrators can configure 'package protection rules' to restrict which roles may publish or modify packages, effectively preventing lower-privileged contributors from overwriting or tampering with production artifacts. The root cause is classified as CWE-1280 (Access Control Check Implemented After Asset is Accessed), meaning the enforcement of these protection rules was sequenced incorrectly - the operation was permitted or partially executed before the access control gate was properly evaluated. The CPE strings confirm both GitLab Community Edition and Enterprise Edition are affected across all platform variants (cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* and cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*), meaning the vulnerable code path exists regardless of licensing tier.
RemediationAI
Upgrade GitLab CE or EE to one of the patched releases: 18.9.7, 18.10.6, or 18.11.3, as documented in the GitLab patch release advisory at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. These versions are confirmed by GitLab's own security disclosure (reported via cve@gitlab.com) and the HackerOne report at https://hackerone.com/reports/3586233. If immediate upgrade is not feasible, a targeted compensating control is to audit and restrict developer-role membership on projects that use package protection rules, reducing the population of accounts that could exploit this path. Alternatively, temporarily disabling package protection rules eliminates the bypass surface but removes the protection entirely - this trade-off should only be considered in low-risk, internal-only registries. No generic controls substitute for patching; the flaw is in the enforcement logic itself.
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today