PT-2026-28096 · Gitlab · Gitlab Ce/Ee

Maksyche

·

Published

2026-03-25

·

Updated

2026-03-31

·

CVE-2026-2370

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 14.3 through 18.8.6 GitLab CE/EE versions 18.9 through 18.9.2 GitLab CE/EE versions 18.10 through 18.10.0
Description An issue exists in GitLab CE/EE related to Jira Connect installations where an authenticated user with minimal workspace permissions could potentially obtain installation credentials and impersonate the GitLab application. This is due to improper authorization checks.
Recommendations Update GitLab CE/EE to version 18.8.7 or later. Update GitLab CE/EE to version 18.9.3 or later. Update GitLab CE/EE to version 18.10.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-233

Related Identifiers

BDU:2026-04333
BIT-GITLAB-2026-2370
CVE-2026-2370

Affected Products

Gitlab Ce/Ee