CVE-2026-5296

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5296
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5296.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5296
Aliases
Downstream
Published
2026-05-27T17:55:18Z
Modified
2026-08-27T11:30:39Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Missing Authorization in GitLab
Details

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that when foundational flows were enabled at the group level, could have allowed an authenticated user with developer-role permissions to bypass flow restrictions under certain conditions.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5296.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "18.7"
                },
                {
                    "fixed": "18.10.7"
                },
                {
                    "introduced": "18.11"
                },
                {
                    "fixed": "18.11.4"
                },
                {
                    "introduced": "19.0"
                },
                {
                    "fixed": "19.0.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "18.7"
                },
                {
                    "fixed": "18.10.7"
                },
                {
                    "introduced": "18.11"
                },
                {
                    "fixed": "18.11.4"
                },
                {
                    "introduced": "19.0"
                },
                {
                    "fixed": "19.0.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
ceaa3c8b3a5ddb810b246bff3029e68cc57caf94
Fixed
0dafa5577c4a4eea262a393392b75b43f2ea80f1
Introduced
1060c7b0ff78be7c8abe8fd6d23dcb1ca493fd78
Fixed
78d6b913cb59e2ae115c4d7ddf4f065e654bbdd4
Introduced
f07e3c5b3c8128be5db112e5b2b618fe31ea1b35
Last Affected
f07e3c5b3c8128be5db112e5b2b618fe31ea1b35
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:19.0.0:*:*:*:enterprise:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "18.7.0"
        },
        {
            "fixed": "18.10.7"
        },
        {
            "introduced": "18.11.0"
        },
        {
            "fixed": "18.11.4"
        },
        {
            "introduced": "19.0.0"
        },
        {
            "last_affected": "19.0.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

19.*
19.0.0
v18.*
v18.11.0-ee
v18.11.2-ee
v19.*
v19.0.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5296.json"