CVE-2026-11379

Analyzed Analyzed - Analysis Complete

Incorrect Authorization in GitLab EE DAST Site Profile Secrets Exfiltration

Publication date: 2026-06-25

Last updated on: 2026-06-26

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-06-26

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-11379

EUVD

EUVD-2026-39170

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 19.0.0 (inc) to 19.0.3 (exc)
gitlab	gitlab	19.1.0
gitlab	gitlab	From 13.11.0 (inc) to 18.11.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Compliance Impact

This vulnerability in GitLab EE allows a user with Developer role to exfiltrate DAST site profile secrets due to incorrect authorization in DAST site profile management.

Exfiltration of secrets could potentially lead to unauthorized access to sensitive data, which may impact compliance with data protection regulations such as GDPR and HIPAA that require strict controls over access to sensitive information.

However, the provided context and resources do not explicitly discuss the impact of this vulnerability on compliance with specific standards or regulations.

Executive Summary

This vulnerability exists in GitLab EE versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1. It involves incorrect authorization in the management of DAST (Dynamic Application Security Testing) site profiles. Specifically, a user with a Developer role could exploit this flaw under certain conditions to exfiltrate secrets stored in DAST site profiles.

Impact Analysis

The impact of this vulnerability is that a user with Developer-level access could gain unauthorized access to sensitive secrets contained within DAST site profiles. This could lead to the exposure of confidential information, potentially compromising the security of applications and systems that rely on these secrets.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. The affected versions are all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1. Upgrading to 18.11.6 or later, 19.0.3 or later, or 19.1.1 or later will remediate the issue.

Hi! I’m here to help you understand CVE-2026-11379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70