PT-2026-44069 · Gitlab · Gitlab Ce/Ee

Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-5296

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.7 through 18.10.6 GitLab EE versions 18.11 through 18.11.3 GitLab EE versions 19.0 through 19.0.0

Description An issue exists where authenticated users with developer-role permissions can bypass flow restrictions under certain conditions when foundational flows are enabled at the group level.

Recommendations Update to version 18.10.7 Update to version 18.11.4 Update to version 19.0.1

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07490

BIT-GITLAB-2026-5296

CVE-2026-5296

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://hackerone.com/reports/3626303 · Exploit
• https://ubuntu.com/security/CVE-2026-5296 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2026-5296 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5296 · Vendor Advisory
• https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07490 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5296 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-5296 · Security Note
• https://twitter.com/CVEnew/status/2059718112174575710 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/595423 · Note
• https://t.me/CVEtracker/55150 · Telegram Post