What is the CVSS score of EUVD-2026-32621?

EUVD-2026-32621 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-32621?

Yes, a patch is available for EUVD-2026-32621. Update the affected software to the latest version immediately.

GitLab EE EUVD-2026-32621

| CVE-2026-2601 MEDIUM

Missing Authorization (CWE-862)

2026-05-27 cve@gitlab.com

GHSA-f3gg-585w-gjj2

Gitlab Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:04 vuln.today

Patch available

May 27, 2026 - 20:04 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to access sensitive deployment data on projects due to improper authorization checks.

AnalysisAI

GitLab Enterprise Edition exposes sensitive deployment data to authenticated users holding only developer-role permissions due to missing authorization checks on deployment-related project resources (CWE-862). Affected versions span a wide range - all EE releases from 11.5 through 18.10.6, 18.11.0 through 18.11.3, and 19.0.0 - making this broadly applicable across unpatched GitLab EE deployments. No public exploit identified at time of analysis per CISA KEV, though SSVC intelligence indicates proof-of-concept code exists, and a HackerOne report (3556381) corroborates researcher discovery.

Technical ContextAI

GitLab EE implements role-based access control (RBAC) for project resources, where developer-level roles are expected to be restricted from sensitive operational data such as deployment environments, secrets, and pipeline deployment outputs. CWE-862 (Missing Authorization) indicates that the code path serving deployment data failed to perform or enforce the correct permission gate, allowing a lower-privileged role to reach data scoped to higher roles such as Maintainer or Owner. The flaw is specific to GitLab EE (Enterprise Edition), not the Community Edition, as deployment management features such as protected environments and deployment approvals are EE-only capabilities. The affected code is traceable via GitLab work item #590389 and the associated HackerOne disclosure.

RemediationAI

Upgrade GitLab EE to one of the patched releases: 18.10.7, 18.11.4, or 19.0.1. The vendor-released patch is documented in the GitLab patch release advisory at https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/. Organizations unable to patch immediately should audit developer-role memberships on projects that handle sensitive deployments and temporarily restrict developer-role access to deployment environments via GitLab EE's Protected Environments feature - configuring deployment approvals to require Maintainer or Owner role reduces exposure at the cost of additional deployment workflow friction. Alternatively, restricting access to the GitLab instance from untrusted networks reduces remote exploitation opportunity, though this does not eliminate insider risk. Review audit logs for anomalous access to deployment data endpoints by developer-level accounts as a detection measure while patching is in progress.