MEDIUM
Access Control Check Implemented After Asset is Accessed in GitLab
Published May 14, 2026
4.3
MEDIUMCVSS 3.1
EPSS 0.39%
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.
Affected products
-
- Version 18.10StatusaffectedConstraints<18.10.6
- Version 18.11StatusaffectedConstraints<18.11.3
- Version 18.3StatusaffectedConstraints<18.9.7
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade to versions 18.9.7, 18.10.6, 18.11.3 or above.
Weaknesses (1)
References (3)
- https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/ Release Notes
- https://gitlab.com/gitlab-org/gitlab/-/work_items/592466 Broken Link
- https://hackerone.com/reports/3586233 technical-descriptionexploitpermissions-requiredPermissions Required
| Link | Providers | Tags |
|---|---|---|
| https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/ | Release Notes | |
| https://gitlab.com/gitlab-org/gitlab/-/work_items/592466 | Broken Link | |
| https://hackerone.com/reports/3586233 | technical-descriptionexploitpermissions-requiredPermissions Required |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitLab
Published May 14, 2026
Updated May 14, 2026
Reserved Mar 5, 2026
Link CVE-2026-3607
CISA Vulnrichment
Updated May 14, 2026