CVE-2026-3607

Published: May 14, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 18.10.0 to 18.10.6
Gitlab Gitlab	From 18.11.0 to 18.11.3
Gitlab Gitlab	From 18.3.0 to 18.9.7
Gitlab Gitlab	From 18.10.0 to 18.10.6
Gitlab Gitlab	From 18.11.0 to 18.11.3
Gitlab Gitlab	From 18.3.0 to 18.9.7

Related CWEs

CWE-1280

Access Control Check Implemented After Asset is Accessed

A product's hardware-based access control check occurs after the asset has been accessed.

References (3)

https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/

Source: cve@gitlab.com

Release Notes

https://gitlab.com/gitlab-org/gitlab/-/work_items/592466

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/3586233

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.