Improper Authorization in GitLab EE Affects User Credential Security
CVE-2026-11827

4.9MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
8 July 2026

What is CVE-2026-11827?

GitLab EE has identified a vulnerability that affects multiple versions, allowing authenticated users with maintainer-role permissions to potentially access another user's stored credentials due to insufficient authorization controls. This issue emphasizes the importance of strict permission management to protect sensitive user information. Users on affected versions are advised to apply available security patches immediately to mitigate risks associated with improper access control.

Affected Version(s)

GitLab 9.5 < 18.11.7

GitLab 19.0 < 19.0.4

GitLab 19.1 < 19.1.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/602478
https://hackerone.com/reports/3720483
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [rogerace](https://hackerone.com/rogerace) for reporting this vulnerability through our HackerOne bug bounty program
.