← Back

CVE-2026-5173

nvd nist
Published: Apr 8, 2026Modified: Jul 24, 2026

JSON object

Loading...
8.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Exploitability: 3.1 / Impact: 4.7
Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 16.9.6 to 18.8.9
Gitlab
From 18.10.0 to 18.10.3
Gitlab
From 18.9.0 to 18.9.5
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 16.9.6 to 18.8.9
Gitlab
From 18.10.0 to 18.10.3
Gitlab
From 18.9.0 to 18.9.5

Related CWEs

CWE-749
Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

References (2)

Source: cve@gitlab.com
Release NotesVendor Advisory
Source: cve@gitlab.com
Broken Link

Timeline

No history available yet.