GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to access sensitive deployment data on projects due to improper authorization checks.
References
| Link | Resource |
|---|---|
| https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/ | Release Notes |
| https://gitlab.com/gitlab-org/gitlab/-/work_items/590389 | Broken Link |
| https://hackerone.com/reports/3556381 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
27 May 2026, 20:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:19.0.0:*:*:*:enterprise:*:*:* |
|
| First Time |
Gitlab gitlab
Gitlab |
|
| References | () https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/ - Release Notes | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/work_items/590389 - Broken Link | |
| References | () https://hackerone.com/reports/3556381 - Permissions Required |
27 May 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 19:16
Updated : 2026-05-27 20:53
NVD link : CVE-2026-2601
Mitre link : CVE-2026-2601
CVE.ORG link : CVE-2026-2601
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-862
Missing Authorization