What is the CVSS score of EUVD-2026-57440?

EUVD-2026-57440 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for EUVD-2026-57440?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57440. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-57440?

Yes, a patch is available for EUVD-2026-57440. Update the affected software to the latest version immediately.

GitLab EE EUVD-2026-57440

| CVE-2026-6821 MEDIUM

Missing Authorization (CWE-862)

2026-08-12 GitLab

GHSA-9gxq-p669-5c5h

Gitlab Authentication Bypass

4.3

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable API endpoint requires only a valid user account (PR:L); no integrity or availability impact; confidentiality limited to merge request metadata.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:08 vuln.today

Patch available

Aug 12, 2026 - 20:03 EUVD

CVE Published

Aug 12, 2026 - 19:05 cve.org

MEDIUM 4.3

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

AnalysisAI

IP-based access restriction bypass in GitLab Enterprise Edition exposes private project merge request metadata to authenticated users who would otherwise be blocked by network-level controls. Affecting all EE versions from 12.0 up to 19.0.6, 19.1.4, and 19.2.2, the flaw stems from a missing authorization check in a merge requests API endpoint that fails to enforce configured IP allowlists. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid GitLab EE user account (PR:L - low privilege, authenticated). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) is defensible for the isolated data exposure, but the real-world risk is modestly higher in environments where IP-based access restrictions serve as a primary or compensating control for sensitive projects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade GitLab EE to version 19.0.6, 19.1.4, or 19.2.2, as released in the GitLab patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/. … Detailed patch versions, workarounds, and compensating controls in full report.