GCVE-110-NCSC-2026-211

Advisory PublishedCVSS 4.3/10

Vulnetix · Advisory published June 25, 2026

GitLab addressed a security flaw in versions 13.6 to before 18.11.6, 19.0 to before 19.0.3, and 19.1 to before 19.1.1 where Reporter-level users could access package metadata from projects with the Package Registry disabled due to improper authorization in the group packages feature.

Download JSON Open in Console

Weaknesses (CWE)

CWE-863Incorrect AuthorizationCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-94Improper Control of Generation of Code ('Code Injection')CWE-862Missing AuthorizationCWE-532Insertion of Sensitive Information into Log FileCWE-350Reliance on Reverse DNS Resolution for a Security-Critical ActionCWE-639Authorization Bypass Through User-Controlled Key

Risk Scores

CVSS 3.1

4.3/10

Medium · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions	Platforms
GitLab	vers:unknown/*	—	—

Aliases

CVE-2026-0934 CVE-2026-10086 CVE-2026-10712 CVE-2026-11379 CVE-2026-12053 CVE-2026-12635 CVE-2026-1606 CVE-2026-2238 CVE-2026-3176 CVE-2026-5309 CVE-2026-5796 CVE-2026-5952 CVE-2026-8330

References

advisory

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON