CVE-2026-6336: gitlab Incorrect Authorization

CVSS: 5.3v3.1MediumAnalyzed

AliasesCGA-2jrp-vpcr-p8j2CGA-35cq-p2wj-346qCGA-3j26-5r4r-7m7c+240 more

Published 29-07-2026Last modified 29-07-2026

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2026-6336 is a medium (CVSS 5.3) Incorrect Authorization vulnerability in gitlab. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.46%

0%100%

Low · +0.20 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-4P4G-GWQ9-X2FX

Timeline

29-07-2026
PublishedVulnerability first disclosed.
29-07-2026
Last modifiedVulnerability information updated.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.

CVSS metrics

4 scores · 4 sources · 1 version

v3.15.3

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

+0.20 pp

From 0.26% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (hackerone.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected systems

Chainguard122 products

gitaly-config-18.11< 18.11.7-r0
gitlab-base-18.11< 18.11.7-r0
gitlab-base-fips-18.11< 18.11.7-r5
gitlab-certificates-18.11< 18.11.7-r0
gitlab-cfssl-self-sign-scripts-18.11< 18.11.7-r0

gitlab-cng-18.11< 18.11.7-r0
gitlab-cng-fips-18.11< 18.11.7-r5
gitlab-container-registry-18.11< 18.11.7-r0
gitlab-container-registry-fips-18.11< 18.11.7-r5
gitlab-container-registry-scripts-18.11< 18.11.7-r0
gitlab-docker-machine-18.11< 18.11.4-r2
gitlab-docker-machine-19.0< 19.0.3-r0
gitlab-docker-machine-19.1< 19.1.2-r1
gitlab-docker-machine-fips-18.11< 18.11.4-r4
gitlab-docker-machine-fips-19.0< 19.0.3-r0
gitlab-docker-machine-fips-19.1< 19.1.2-r0
gitlab-exporter-18.11< 18.11.7-r0
gitlab-exporter-scripts-18.11< 18.11.7-r0
gitlab-gitaly-scripts-18.11< 18.11.7-r0
gitlab-logger-18.11< 18.11.7-r0
gitlab-logger-fips-18.11< 18.11.7-r5
gitlab-pages-scripts-18.11< 18.11.7-r0
gitlab-rails-ce-18.1< 18.1.6-r26
gitlab-rails-ce-18.10< 18.10.8-r6
gitlab-rails-ce-18.11< 18.11.7-r0
gitlab-rails-ce-18.6< 18.6.8-r5
gitlab-rails-ce-18.7< 18.7.7-r4
gitlab-rails-ce-18.8< 18.8.11-r4
gitlab-rails-ce-18.9< 18.9.8-r7
gitlab-rails-ce-assets-18.1< 18.1.6-r26
gitlab-rails-ce-assets-18.10< 18.10.8-r6
gitlab-rails-ce-assets-18.11< 18.11.7-r0
gitlab-rails-ce-assets-18.6< 18.6.8-r5
gitlab-rails-ce-assets-18.7< 18.7.7-r4
gitlab-rails-ce-assets-18.8< 18.8.11-r4
gitlab-rails-ce-assets-18.9< 18.9.8-r7
gitlab-rails-ce-assets-fips-18.1< 18.1.6-r80
gitlab-rails-ce-assets-fips-18.10< 18.10.8-r7
gitlab-rails-ce-assets-fips-18.11< 18.11.7-r5
gitlab-rails-ce-assets-fips-18.6< 18.6.8-r5
gitlab-rails-ce-assets-fips-18.7< 18.7.7-r4
gitlab-rails-ce-assets-fips-18.8< 18.8.11-r4
gitlab-rails-ce-assets-fips-18.9< 18.9.8-r4
gitlab-rails-ce-assets-fips-19.0< 19.0.5-r0
gitlab-rails-ce-doc-18.1< 18.1.6-r26
gitlab-rails-ce-doc-18.10< 18.10.8-r6
gitlab-rails-ce-doc-18.11< 18.11.7-r0
gitlab-rails-ce-doc-18.6< 18.6.8-r5
gitlab-rails-ce-doc-18.7< 18.7.7-r4
gitlab-rails-ce-doc-18.8< 18.8.11-r4
gitlab-rails-ce-doc-18.9< 18.9.8-r7
gitlab-rails-ce-doc-fips-18.1< 18.1.6-r80
gitlab-rails-ce-doc-fips-18.10< 18.10.8-r7
gitlab-rails-ce-doc-fips-18.11< 18.11.7-r5
gitlab-rails-ce-doc-fips-18.6< 18.6.8-r5
gitlab-rails-ce-doc-fips-18.7< 18.7.7-r4
gitlab-rails-ce-doc-fips-18.8< 18.8.11-r4
gitlab-rails-ce-doc-fips-18.9< 18.9.8-r4
gitlab-rails-ce-doc-fips-19.0< 19.0.5-r0
gitlab-rails-ce-fips-18.1< 18.1.6-r80
gitlab-rails-ce-fips-18.10< 18.10.8-r7
gitlab-rails-ce-fips-18.11< 18.11.7-r5
gitlab-rails-ce-fips-18.6< 18.6.8-r5
gitlab-rails-ce-fips-18.7< 18.7.7-r4
gitlab-rails-ce-fips-18.8< 18.8.11-r4
gitlab-rails-ce-fips-18.9< 18.9.8-r4
gitlab-rails-ce-fips-19.0< 19.0.5-r0
gitlab-rails-scripts-18.11< 18.11.7-r0
gitlab-rails-scripts-fips-18.11< 18.11.7-r5
gitlab-runner-18.11< 18.11.4-r2
gitlab-runner-19.0< 19.0.3-r0
gitlab-runner-19.1< 19.1.2-r1
gitlab-runner-fips-18.11< 18.11.4-r4
gitlab-runner-fips-19.0< 19.0.3-r0
gitlab-runner-fips-19.1< 19.1.2-r0
gitlab-runner-helper-18.11< 18.11.4-r2
gitlab-runner-helper-19.0< 19.0.3-r0
gitlab-runner-helper-19.1< 19.1.2-r1
gitlab-runner-helper-compat-18.11< 18.11.4-r2
gitlab-runner-helper-compat-19.0< 19.0.3-r0
gitlab-runner-helper-compat-19.1< 19.1.2-r1
gitlab-runner-helper-compat-fips-18.11< 18.11.4-r4
gitlab-runner-helper-compat-fips-19.0< 19.0.3-r0
gitlab-runner-helper-compat-fips-19.1< 19.1.2-r0
gitlab-runner-helper-fips-18.11< 18.11.4-r4
gitlab-runner-helper-fips-19.0< 19.0.3-r0
gitlab-runner-helper-fips-19.1< 19.1.2-r0
gitlab-runner-helper-oci-entrypoint-18.11< 18.11.4-r2
gitlab-runner-helper-oci-entrypoint-19.0< 19.0.3-r0
gitlab-runner-helper-oci-entrypoint-19.1< 19.1.2-r1
gitlab-runner-helper-oci-entrypoint-fips-18.11< 18.11.4-r4
gitlab-runner-helper-oci-entrypoint-fips-19.0< 19.0.3-r0
gitlab-runner-helper-oci-entrypoint-fips-19.1< 19.1.2-r0
gitlab-runner-oci-entrypoint-18.11< 18.11.4-r2
gitlab-runner-oci-entrypoint-19.0< 19.0.3-r0
gitlab-runner-oci-entrypoint-19.1< 19.1.2-r1
gitlab-runner-oci-entrypoint-fips-18.11< 18.11.4-r4
gitlab-runner-oci-entrypoint-fips-19.0< 19.0.3-r0
gitlab-runner-oci-entrypoint-fips-19.1< 19.1.2-r0
gitlab-shell-18.11< 18.11.7-r0
gitlab-shell-fips-18.11< 18.11.7-r5
gitlab-shell-scripts-18.11< 18.11.7-r0
gitlab-sidekiq-ce-18.11< 18.11.7-r0
gitlab-sidekiq-ce-fips-18.11< 18.11.7-r5
gitlab-toolbox-ce-18.11< 18.11.7-r0
gitlab-toolbox-ce-fips-18.11< 18.11.7-r5
gitlab-webservice-ce-18.11< 18.11.7-r0
gitlab-webservice-ce-fips-18.11< 18.11.7-r5
gitlab-workhorse-ce-18.10< 18.10.8-r3
gitlab-workhorse-ce-18.11< 18.11.8-r0
gitlab-workhorse-ce-18.6< 18.6.8-r4
gitlab-workhorse-ce-18.7< 18.7.7-r4
gitlab-workhorse-ce-18.8< 18.8.11-r2
gitlab-workhorse-ce-18.9< 18.9.8-r5
gitlab-workhorse-ce-fips-18.10< 18.10.8-r4
gitlab-workhorse-ce-fips-18.11< 18.11.8-r1
gitlab-workhorse-ce-fips-18.6< 18.6.8-r6
gitlab-workhorse-ce-fips-18.7< 18.7.7-r5
gitlab-workhorse-ce-fips-18.8< 18.8.11-r4
gitlab-workhorse-ce-fips-18.9< 18.9.8-r5
gitlab-workhorse-scripts-18.11< 18.11.7-r0
gitlab-workhorse-scripts-fips-18.11< 18.11.7-r5

Show all 122

Wolfi18 products

gitlab-docker-machine-18.11< 18.11.4-r2
gitlab-docker-machine-19.0< 19.0.3-r0
gitlab-docker-machine-19.1< 19.1.2-r1
gitlab-runner-18.11< 18.11.4-r2
gitlab-runner-19.0< 19.0.3-r0

Show all 18

Gitlab1 product

gitlabEOL≥ 16.6, < 19.0.5 | ≥ 19.1, < 19.1.3 | ≥ 19.2, < 19.2.1 | ≥ 16.6.0, < 19.0.5 | ≥ 19.1.0, < 19.1.3 | 19.2.0

3 vendors · 141 products

References

5 links

gitlab.com/gitlab-org/gitlab/-/work_items/596762WEBBroken Link
hackerone.com/reports/3661988Technical DescriptionExploitPermissions RequiredREPORT
docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/WEBRelease NotesVendor Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6336.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-6336Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities