CVE-2026-2619
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability was found in GitLab EE due to incorrect authorization, which under certain circumstances allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects.
Risk Assessment
The risk involves unauthorized modification of vulnerability flag data in private projects by an auditor-privileged user, potentially compromising the integrity and confidentiality of security information.
Recommendation
Immediately upgrade GitLab EE to version 18.8.9, 18.9.5, or 18.10.3, depending on the branch in use, to remediate the vulnerability.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.