CVE-2026-10518

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-10518

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10518.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-10518

Published

2026-09-29T09:35:28Z

Modified

2026-10-01T03:47:18Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Incorrect Authorization in GitLab

Details

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.

Database specific

{
    "cna_assigner":  "GitLab",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10518.json"
}

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type

GIT

Repo

https://gitlab.com/gitlab-org/gitlab

Events

Introduced

f5041566b342c2f30a8d63b8117272c454e18410

Fixed

9fcb5013c2e849eaec247e3aec56f23b51b6d7dd

Introduced

8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6

Fixed

5760a902b6c8d001a0e0212aedee40bd69d28a2d

Introduced

fa703f93afaf1133cd263f6aa0e91d284d7f1ebf

Fixed

26212baacadb5beea6664f7ef025d753dccfb0d6

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "17.9"
        },
        {
            "fixed":  "19.2.7"
        },
        {
            "introduced":  "19.3"
        },
        {
            "fixed":  "19.3.3"
        },
        {
            "introduced":  "19.4"
        },
        {
            "fixed":  "19.4.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v19.*

v19.3.0-ee

v19.4.0-ee

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10518.json"