EUVD-2026-85732
GHSA-c3rm-3hqr-4qwm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid MCP-scoped token
-
DeliverySend API request to out-of-scope action
-
ExploitServer skips proper scope authorization check
-
ExecutionPerform action beyond token scope
-
ImpactRead or modify unauthorized GitLab resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a valid GitLab MCP-scoped (Model Context Protocol) token - the flaw lets such a token perform actions beyond its intended scope because the authorization check is improperly enforced. It applies to GitLab CE/EE versions 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, and only 'under certain conditions,' implying a specific request path or MCP feature usage rather than any arbitrary call. Limiting factors: an authenticated MCP-scoped token is a prerequisite (PR:L), impact is limited to low confidentiality and low integrity with no availability effect, and deployments not using MCP token integrations are unlikely to be exposed. |
| Impact | This is a moderate-severity, real-but-not-urgent issue. The vendor CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is consistent with the description: an authenticated attacker with a valid but MCP-scoped token can exceed the token's intended scope due to improper authorization (CWE-863), yielding limited confidentiality and integrity impact and no availability impact. Exploitation is network-reachable with low complexity but requires the attacker to already possess a valid MCP-scoped token (PR:L), so this is a privilege/scope-escalation bug rather than an unauthenticated compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data - so this is no public exploit identified at time of analysis, and there is no signal of active or widespread exploitation. The description's 'under certain conditions' qualifier and the newness of MCP (Model Context Protocol) token functionality further limit the realistic attack surface. Net: patch on a normal cadence; it is a legitimate authorization defect but not a high-real-risk, drop-everything item. No SSVC decision data was provided to cross-reference. |
| Exploit ScenarioDerived | An attacker who has obtained a GitLab MCP-scoped token (e.g., a token issued for a narrow Model Context Protocol integration) sends crafted API requests to actions the token was never meant to reach. Because the authorization check does not properly enforce the token's scope, the requests succeed and the attacker reads or modifies resources beyond the intended boundary. No public exploit code is identified, and exploitation requires already holding a valid MCP-scoped token. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Improper authorization in GitLab CE/EE (all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1) lets an authenticated user who holds an MCP-scoped token perform actions outside that token's intended scope, resulting in low confidentiality and low integrity impact with no availability effect (CVSS 5.4). The flaw is only reachable by a remote attacker who already possesses a valid MCP-scoped token (PR:L per the assessed vector), and GitLab states the over-scoping occurs only 'under certain conditions,' implying a specific MCP request path or feature usage rather than arbitrary API calls. This is a moderate-severity, real-but-not-urgent issue: no public exploit code was identified at time of analysis, no CISA KEV entry exists, and deployments that do not use MCP token integrations are unlikely to be exposed.
RemediationAI
Vendor-released patch: upgrade to GitLab 19.2.7, 19.3.3, or 19.4.1 depending on your current release line, following the official patch release notes at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/; the fix details are referenced in https://gitlab.com/gitlab-org/gitlab/-/work_items/618614. If immediate upgrade is not possible, the most effective compensating control is to revoke or rotate all MCP-scoped tokens (and any personal access tokens issued for MCP/agent integrations) and to temporarily disable MCP integration features in the affected instance - the trade-off is that AI/agent tooling and any automations using those tokens will stop working until they are re-issued after patching. Additionally, restrict which account roles are permitted to mint MCP-scoped tokens, since the flaw elevates such a token to the full privileges of its owning account, and audit token inventory plus authorization logs for MCP-related API calls made outside the expected scope to detect any prior abuse. Because exploitation requires a valid MCP-scoped token and no public exploit code was identified at time of analysis, these token-hygiene measures are a reasonable interim posture rather than an emergency containment step; note that revoking tokens and disabling MCP features are disruptive to in-flight integrations and should be coordinated with the teams relying on them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863 (Incorrect Authorization): GitLab's authorization check for Model Context Protocol (MCP) scoped tokens is improperly enforced, so a token intended to be constrained to a narrow MCP scope is accepted for operations it should not authorize. MCP is the protocol used to expose GitLab functionality to AI agents and tooling, and MCP-scoped tokens are deliberately narrow-by-design credentials; when the authorization decision fails to validate the token's scope against the requested action, the effective privilege of that token is broadened to whatever the underlying user account can do. The affected CPE (cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*) covers both Community Edition and Enterprise Edition, i.e. this is not limited to an EE-only feature gating issue. Because the assessed vector is AV:N/AC:L/PR:L/UI:N/S:U, exploitation is network-reachable, low-complexity, requires no user interaction, and does not cross a security scope boundary - the impact is confined to the privileges already available within the GitLab instance.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable, low-complexity API abuse requiring a valid MCP-scoped token (PR:L); scope-exceeding actions yield limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Remote code execution in GitLab CE/EE (all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2)
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vul
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Exploit-DB