Authorization Flaw in GitLab EE for Specific Versions
CVE-2026-4363

3.7LOW

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
25 March 2026

What is CVE-2026-4363?

GitLab EE has been identified as having an authorization flaw that could permit an authenticated user to access restricted resources. This issue arises from the improper caching of authorization decisions, which can compromise the security of sensitive data. The vulnerability is present in various versions from 18.1 through 18.10.1, highlighting the importance of keeping software updated to mitigate such risks. Users should ensure they are operating on the latest version to protect against potential unauthorized access. For more details, refer to the official GitLab announcements regarding the issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

GitLab 18.1 < 18.8.7

GitLab 18.9 < 18.9.3

GitLab 18.10 < 18.10.1

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/578561
https://about.gitlab.com/releases/2026/03/25/patch-releas...

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability has been discovered internally by GitLab team member Fred de Gier
JSON
.