Improper Authorization in GitLab CE/EE Affects Multiple Versions
CVE-2026-5954

4.2MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

What is CVE-2026-5954?

A significant security vulnerability has been identified in GitLab CE/EE that affects various versions, specifically from 15.1 to 19.2.8, 19.3 up until 19.3.5, and 19.4 before 19.4.2. This vulnerability arises from inadequate authorization checks, which may allow an authenticated user to inadvertently download package files from public projects. This flaw underscores the necessity for rigorous access controls and proper validation mechanisms to safeguard sensitive resources from unauthorized access, ensuring the overall security of GitLab projects and the integrity of their data.

Affected Version(s)

GitLab 15.1 < 19.2.8

GitLab 19.3 < 19.3.5

GitLab 19.4 < 19.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/596139
https://hackerone.com/reports/3641043
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [rogerace](https://hackerone.com/rogerace) for reporting this vulnerability through our HackerOne bug bounty program
.