CVE-2026-6567

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6567
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6567.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6567
Aliases
Downstream
CGA (168)
MINI (51)
UBUNTU (1)
Published
2026-10-13T01:09:46Z
Modified
2026-10-30T10:47:19Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6567.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1ae10d096922ba13b0ffaa20ab616f86dbeb5a89
Fixed
9a42f777a0147768457ebe684e13e69d54eee652
Introduced
8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6
Fixed
ce7cbf1bcc4e49e98f209097d5081030e30410c5
Introduced
fa703f93afaf1133cd263f6aa0e91d284d7f1ebf
Fixed
9c053f678a4924425869b1b9e4bca3a44e45edf7
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "13.8.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "13.8.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v19.*
v19.3.0-ee
v19.4.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6567.json"