EUVD-2026-32742
GHSA-77hj-c554-4343
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked Project Access Token to continue accessing private resources due to incorrect authorization enforcement.
AnalysisAI
Incorrect authorization enforcement in GitLab CE/EE permits a blocked Project Access Token to continue reading private project resources despite administrative revocation. Affected are all GitLab CE/EE instances running versions 18.9 through 18.10.6, 18.11 through 18.11.3, and 19.0.0 - patched versions 18.10.7, 18.11.4, and 19.0.1 were released 2026-05-27. …
Sign in for full analysis, threat intelligence, and remediation guidance.
More from same product – last 7 days
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands th
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo
Denial of service in GitLab CE/EE affects all versions from 17.1 through those prior to 18.10.7, 18.11.4, and 19.0.1, al
Unauthorized private project enumeration in GitLab CE/EE exposes confidential project metadata to unauthenticated networ
GitLab Enterprise Edition exposes sensitive deployment data to authenticated users holding only developer-role permissio
Share
External POC / Exploit Code
Leaving vuln.today