CVE-2026-2104

Katalog CVE

CVSS 4.3 · Medium EPSS 0,31%

Kerentanan Authorization Bypass Through User-Controlled Key pada gitlab. Skor CVSS 3.1 4.3 (Medium) menurut gitlab.com.

Deskripsi (NVD)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

25 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber gitlab.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/ release notes · advisory vendor
• https://gitlab.com/gitlab-org/gitlab/-/work_items/589021 broken link
• https://hackerone.com/reports/3541476 permissions required