CVE-2026-11379

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/	Release Notes Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/517659	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:19.1.0::::enterprise:::

History

26 Jun 2026, 18:34

Type	Values Removed	Values Added
First Time		Gitlab Gitlab gitlab
References	~~() https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/ -~~	() https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/ - Release Notes, Vendor Advisory
References	~~() https://gitlab.com/gitlab-org/gitlab/-/work_items/517659 -~~	() https://gitlab.com/gitlab-org/gitlab/-/work_items/517659 - Broken Link
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:19.1.0::::enterprise:::

25 Jun 2026, 05:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-25 05:16

Updated : 2026-06-26 18:34

NVD link : CVE-2026-11379

Mitre link : CVE-2026-11379

CVE.ORG link : CVE-2026-11379

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-11379", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11379", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T13:10:02.747596Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "13.11", "lessThan": "18.11.6", "versionType": "semver"}, {"status": "affected", "version": "19.0", "lessThan": "19.0.3", "versionType": "semver"}, {"status": "affected", "version": "19.1", "lessThan": "19.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-25T05:16:50.767", "references": [{"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/517659", "tags": ["Broken Link"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions."}], "lastModified": "2026-06-26T18:34:26.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2248E1A1-D78E-4BD8-A5D3-29F93FE2A2D8", "versionEndExcluding": "18.11.6", "versionStartIncluding": "13.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D398AA66-56F3-4ED2-AD85-E2C094EE577E", "versionEndExcluding": "19.0.3", "versionStartIncluding": "19.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:19.1.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "49957E0D-C888-4AB1-9C15-8CD6E55454B1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}