PT-2026-40861 · Gitlab · Gitlab Ce/Ee

Published 2026-05-14 · Updated 2026-05-18 · CVE-2026-3073

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.6 through 18.9.6 GitLab CE/EE versions 18.10 through 18.10.5 GitLab CE/EE versions 18.11 through 18.11.2

Description Improper authorization checks allow an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages.

Recommendations Update to version 18.9.7 Update to version 18.10.6 Update to version 18.11.3

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-07015

BIT-GITLAB-2026-3073

CVE-2026-3073

Affected Products

Gitlab Ce/Ee

References · 9

• 🔥 https://hackerone.com/reports/3532563 · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2026-3073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3073 · Security Note
• https://ubuntu.com/security/CVE-2026-3073 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07015 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-3073 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3073 · Vendor Advisory
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/591227 · Note