PT-2026-40858 · Gitlab · Gitlab Ce/Ee

Published 2026-05-14 · Updated 2026-05-18 · CVE-2026-1322

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.0 through 18.9.6 GitLab CE/EE versions 18.10 through 18.10.5 GitLab CE/EE versions 18.11 through 18.11.2

Description Improper authorization allows an authenticated user possessing a read api scoped OAuth application to create issues and add comments to issues within private projects.

Recommendations Update to version 18.9.7 Update to version 18.10.6 Update to version 18.11.3

Exploit

Fix

Weakness Enumeration

CWE-840

Related Identifiers

BDU:2026-07012

BIT-GITLAB-2026-1322

CVE-2026-1322

Affected Products

Gitlab Ce/Ee

References · 10

• 🔥 https://hackerone.com/reports/3508895 · Exploit
• https://cve.org/CVERecord?id=CVE-2026-1322 · Security Note
• https://ubuntu.com/security/CVE-2026-1322 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1322 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-1322 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07012 · Security Note
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/587270 · Note
• https://t.me/cveNotify/163733 · Telegram Post