PT-2026-40862 · Gitlab · Gitlab Ce/Ee

Published 2026-05-14 · Updated 2026-05-18 · CVE-2026-3074

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.7 through 18.9.6 GitLab CE/EE versions 18.10 through 18.10.5 GitLab CE/EE versions 18.11 through 18.11.2

Description Improper access control allows an unauthenticated user to download private debugging symbols from projects they cannot access.

Recommendations Update versions 16.7 through 18.9.6 to 18.9.7. Update versions 18.10 through 18.10.5 to 18.10.6. Update versions 18.11 through 18.11.2 to 18.11.3.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-07016

BIT-GITLAB-2026-3074

CVE-2026-3074

Affected Products

Gitlab Ce/Ee

References · 9

• 🔥 https://hackerone.com/reports/3556163 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3074 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-3074 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-3074 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3074 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07016 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3074 · Vendor Advisory
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/591229 · Note