VDB

CVE-2026-6277

CVE-2026-6277 PUBLISHED CVSS 4.3 MEDIUM

Reported by GitLab · Published June 11, 2026

GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage project security configuration even when the relevant feature was in a disabled state, due to incorrect authorization enforcement.

Risk Scores

CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Products

VendorProductVersions
GitLabGitLab13.9, 18.11, 19.0
GitLabGitLab13.9, 18.11, 19.0
wolfigitlab-runner-19.00, 0, 0

Timeline

  • Jun 11, 2026 CVE Published
  • Jun 12, 2026 Coalition ESS Score
  • Jun 12, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›