EUVD-2026-98230
GHSA-p26w-35r3-7x6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged GitLab user
-
ExploitCraft package file download request
-
ExecutionBypass improper authorization check (CWE-863)
-
ImpactRetrieve restricted package files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated GitLab user account (PR:L) and is limited to 'certain conditions' not fully enumerated in the advisory, consistent with the high attack complexity (AC:H) - exploitation is not reliable against arbitrary configurations. The concrete prerequisite is the GitLab package registry feature being in use with package files associated with a public project, where the improper authorization check (CWE-863) fails to properly gate download access. No user interaction is required (UI:N). The flaw is network-reachable (AV:N) but is bounded to unauthorized disclosure of package files only; it does not grant code execution, modification, or availability impact. |
| Impact | This is a genuinely low-to-moderate priority issue, not a high-severity emergency. The CVSS 3.1 base score of 4.2 (Medium) is driven by limited confidentiality impact (C:L) with no integrity or availability impact, and is further constrained by high attack complexity (AC:H, reflecting the 'under certain conditions' language) and a requirement for low-privilege authentication (PR:L). Publicly available exploit code exists (referenced HackerOne report #3641043), which raises practical risk somewhat, but the vulnerability is NOT listed in CISA KEV and no EPSS score was supplied in the input, so there is no evidence of active or widespread exploitation. The signals are internally consistent: a network-reachable but complexity- and privilege-gated authorization flaw with narrow impact. No signal conflict was detected. Note: the CVSS vector in the input claims integrity impact (I:L), but the description only describes unauthorized DOWNLOAD (read) of package files, which is a confidentiality concern - this apparent over-scoping should be verified against the GitLab advisory. |
| Exploit ScenarioDerived | A low-privileged authenticated GitLab user leverages the improper authorization check to download package files from a public project that they should not be able to access under the project's intended permission model. A public exploit demonstrating the flaw is referenced via a HackerOne report, though triggering it requires the specific conditions that make exploitation non-trivial (AC:H). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Improper authorization checks in GitLab CE/EE (CWE-863) allow an authenticated user to download package files belonging to a public project through the package registry when they should not have access, effectively bypassing project visibility and package-level access controls. The issue affects all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; the CVSS vector (AV:N/AC:H/PR:L/UI:N) requires a valid account and depends on 'certain conditions' that are not fully enumerated, so exploitation is not reliable against arbitrary configurations. Publicly available exploit code exists - details were reported via HackerOne - but the CVE is not listed in CISA KEV, and the assessed impact is limited to unauthorized disclosure of package files, with no code execution, data modification, or availability impact, making this a low-to-moderate priority issue rather than an emergency.
RemediationAI
Vendor-released patches exist: upgrade to GitLab 19.2.8, 19.3.5, or 19.4.2 (or later) as appropriate for your release line, following the patch release advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/; GitLab-hosted customers are patched automatically, while self-managed administrators should schedule the upgrade promptly, noting that minor-version upgrades to 19.3.5/19.4.2 also bring unrelated fixes and require the usual maintenance window. Because exploitation requires a valid authenticated account (PR:L) and cannot be triggered reliably against arbitrary configurations (AC:H), the practical risk is bounded, but until upgrading you can reduce exposure by disabling the package registry for projects whose packages are sensitive (Settings > General > Visibility, project features, permissions), restricting package registry use to private/internal projects, or narrowing network access to the package registry endpoints (for example /api/v4/projects/:id/packages) at the reverse proxy or firewall - recognizing that each of these degrades normal artifact distribution workflows and blocking the API path may break CI/CD pipelines that legitimately pull packages. There is no indication of active exploitation in CISA KEV, so prioritization should weigh package-registry usage and artifact sensitivity rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863 (Incorrect Authorization): GitLab's package registry failed to properly validate that a requesting user was entitled to the package files associated with a project, so an authenticated account could retrieve artifacts it should not see. The relevant technology is GitLab's built-in package registry (the storage and API layer that serves Maven, npm, NuGet, PyPI, Composer, generic, and similar package artifacts tied to a project), and the failure is an access-control gate on that download path rather than a memory-safety or injection flaw. The CPE entry cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* confirms that both Community and Enterprise editions of the core GitLab product are in scope across the 15.1-19.4 version line. The supplied CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) indicates the flaw is network-reachable but requires authentication and a specific, non-default set of conditions - consistent with a high attack complexity - and the independent assessment narrows the impact to confidentiality only (C:L/I:N/A:N), so the practical consequence is unauthorized read access to package artifacts, not tampering or denial of service.
Know when Gitlab gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable but needs an authenticated account (PR:L) and only works under specific conditions (AC:H); impact is unauthorized file download, so C:L with I:N/A:N (diverging from input's I:L).
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in GitLab CE/EE Authorization and Access Control Flaws
View all 24An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Authenticated code execution on the GitLab server is possible in GitLab CE/EE 19.2 through 19.4.0, where an integer over
Authenticated users who can define or modify a CI/CD configuration can achieve remote code execution on GitLab CE/EE ser
Unauthenticated path traversal in the @zereight/mcp-gitlab Model Context Protocol server prior to version 2.1.27 allows
Exploit-DB