PT-2026-27784 · Gitlab · Gitlab Ce/Ee

Published 2026-03-25 · Updated 2026-03-27 · CVE-2026-4363

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 18.1 through 18.8.7 GitLab versions 18.9 through 18.9.3 GitLab versions 18.10 through 18.10.1

Description An issue existed in GitLab EE where, under specific conditions, an authenticated user could obtain unauthorized access to resources. This was due to incorrect caching of authorization decisions.

Recommendations Update GitLab EE to version 18.8.7 or later. Update GitLab EE to version 18.9.3 or later. Update GitLab EE to version 18.10.1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-06383

BIT-GITLAB-2026-4363

CVE-2026-4363

Affected Products

Gitlab Ce/Ee

References · 8

• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4363 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-4363 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06383 · Security Note
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-10-1-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/578561 · Note
• https://twitter.com/CVEarity/status/2037058166597562701 · Twitter Post
• https://twitter.com/threatcluster/status/2037272274806448604 · Twitter Post