CVE-2026-3035

Published: Aug 26, 2026Modified: Aug 31, 2026

5.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 11.3.0 to 19.1.7
Gitlab Gitlab	From 19.2.0 to 19.2.5
Gitlab Gitlab	Version 19.3.0

Related CWEs

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/591189

Source: cve@gitlab.com

Issue TrackingVendor Advisory

https://hackerone.com/reports/3529751

Source: cve@gitlab.com

Permissions RequiredThird Party Advisory

Timeline

No history available yet.