CVE-2026-11827

Published: Jul 8, 2026Modified: Jul 9, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentials due to improper authorization controls.

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 19.0.0 to 19.0.4
Gitlab Gitlab	From 19.1.0 to 19.1.2
Gitlab Gitlab	From 9.5.0 to 18.11.7

Related CWEs

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

Source: cve@gitlab.com

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/602478

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/3720483

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.