GCVE-110-NCSC-2026-297

Advisory PublishedCVSS 8.5/10

Vulnetix · Advisory published August 13, 2026

GitLab addressed a security flaw in multiple Enterprise Edition versions where users with pending membership could incorrectly gain permissions from custom roles due to improper privilege assignment.

Download JSON Open in Console

Weaknesses (CWE)

CWE-266Incorrect Privilege AssignmentCWE-862Missing AuthorizationCWE-770Allocation of Resources Without Limits or ThrottlingCWE-863Incorrect AuthorizationCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-639Authorization Bypass Through User-Controlled Key

Risk Scores

CVSS 3.1

8.5/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Affected Products

Vendor	Product	Versions	Platforms
GitLab	vers:unknown/*	—	—

Aliases

CVE-2025-9486 CVE-2026-15216 CVE-2026-15217 CVE-2026-15423 CVE-2026-16494 CVE-2026-16627 CVE-2026-18244 CVE-2026-18433 CVE-2026-19228 CVE-2026-4879 CVE-2026-6821 CVE-2026-7427 CVE-2026-8667

References

advisory

Browse GCVE Records

482 records in the GCVE database · Updated August 26, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON