PT-2026-27809 · Gitlab · Gitlab Ce/Ee

Published 2026-03-25 · Updated 2026-03-27 · CVE-2026-1724

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.5 through 18.8.6 GitLab EE versions 18.9 through 18.9.2 GitLab EE versions 18.10 through 18.10.0

Description An improper access control issue existed in GitLab EE that allowed an unauthenticated user to access API tokens of self-hosted AI models. The issue affected the access control mechanisms related to AI model API tokens.

Recommendations Update GitLab EE to version 18.8.7 or later. Update GitLab EE to version 18.9.3 or later. Update GitLab EE to version 18.10.1 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-06384

BIT-GITLAB-2026-1724

CVE-2026-1724

Affected Products

Gitlab Ce/Ee

References · 8

• 🔥 https://hackerone.com/reports/3531412 · Exploit
• https://bdu.fstec.ru/vul/2026-06384 · Security Note
• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1724 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-1724 · Vendor Advisory
• https://twitter.com/CVEnew/status/2036911837502214649 · Twitter Post
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-10-1-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/588334 · Note