PT-2026-44067 · Gitlab · Gitlab Ce/Ee

Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-2601

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.5 through 18.10.6 GitLab EE versions 18.11 through 18.11.3 GitLab EE versions 19.0 through 19.0.0

Description An improper authorization check allows an authenticated user with developer-role permissions to access sensitive deployment data on projects under certain conditions.

Recommendations Update to version 18.10.7 Update to version 18.11.4 Update to version 19.0.1

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07482

BIT-GITLAB-2026-2601

CVE-2026-2601

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://hackerone.com/reports/3556381 · Exploit
• https://ubuntu.com/security/CVE-2026-2601 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2601 · Security Note
• https://bdu.fstec.ru/vul/2026-07482 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-2601 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2601 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/590389 · Note
• https://t.me/cveNotify/164933 · Telegram Post
• https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released · Note
• https://twitter.com/CVEnew/status/2059718109980991950 · Twitter Post