What is the CVSS score of EUVD-2026-36229?

EUVD-2026-36229 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GitLab EE are affected by EUVD-2026-36229?

GitLab Enterprise Edition versions 15.5-19.0.1 allow group owners to compromise other team members' accounts through authorization bypass, exposing organizations to insider threats and unauthorized…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-36229?

Yes, a public proof-of-concept exploit is available for EUVD-2026-36229. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-36229?

Within 24 hours: inventory all GitLab Enterprise Edition instances and identify those running versions 15.5-19.0.1. Within 7 days: upgrade to patched versions 18.10.8, 18.11.5, or 19.0.2 (released 2026-06-10), validate functionality in staging, and initiate staged rollout across production. Within 30 days: complete patching of all instances and conduct comprehensive audit of access logs from the past 30 days to identify unauthorized account access or privilege escalation activities.

GitLab EE EUVD-2026-36229

| CVE-2026-6552 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-11 GitLab

GHSA-r82j-g6q9-mvx8

Gitlab Authentication Bypass

8.7

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-reachable web flow, low complexity, requires high-privilege group Owner role, no user interaction, scope changes to victim account with full confidentiality and integrity loss but no availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 13:01 EUVD

Analysis Generated

Jun 11, 2026 - 11:53 vuln.today

CVE Published

Jun 11, 2026 - 10:20 cve.org

HIGH 8.7

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with group Owner role to take over another group member's GitLab account due to improper authorization in the Group SAML identity management functionality.

Articles & Coverage 2

News 5 New GitLab Vulnerabilities - 5 High Severity, 4 With POC Jun 12, 2026 News 4 New GitLab Vulnerabilities - 4 High Severity, All With POC Jun 11, 2026

AnalysisAI

Account takeover in GitLab Enterprise Edition versions 15.5 through 19.0.2 allows an authenticated group Owner to hijack other group members' accounts through improper authorization in the Group SAML identity management functionality. Publicly available exploit code exists via a HackerOne report, and GitLab released patched versions 18.10.8, 18.11.5, and 19.0.2 on 2026-06-10. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key) and yields a scope-changing high-impact compromise per CVSS 3.1.

Technical ContextAI

The vulnerability resides in GitLab EE's Group SAML identity management subsystem (cpe:2.3:a:gitlab:gitlab), which lets self-managed group administrators federate group membership to an external SAML identity provider and bind SAML NameIDs to GitLab user identities. CWE-639 (Authorization Bypass Through User-Controlled Key) indicates the SAML identity-binding flow trusts an attribute that a group Owner can influence, causing the server to associate an attacker-supplied identity with another user's account rather than enforcing that the binding operation be scoped only to the actor themselves. Because Group SAML is an Enterprise-Edition feature, only EE tiers (Premium/Ultimate) self-managed and GitLab.com groups configured with Group SAML SSO are in scope.

RemediationAI

Vendor-released patches are available: upgrade self-managed GitLab EE to 18.10.8, 18.11.5, or 19.0.2 (or later) per the GitLab patch release at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/; GitLab.com is already updated by the vendor. If immediate patching is not possible, the practical compensating control is to temporarily disable or unconfigure Group SAML on affected groups and rely on direct GitLab authentication or instance-level SAML/SSO until upgrade - the trade-off is that group members lose IdP-driven provisioning and SSO convenience and may need password/2FA resets. Additionally, audit recent SAML identity bindings and group membership/identity-link changes for any unexpected NameID rebindings, and tighten which users hold the Owner role on groups configured with SAML, since the role is the precondition for exploitation.