CVE-2026-6267
Received
Received - Intake
Authenticated Information Exposure in GitLab CE/EE
Vulnerability report for CVE-2026-6267, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-29
Last updated on: 2026-07-30
Assigner: GitLab Inc.
Description
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab_ce | From 10.1.0 (inc) to 19.0.5 (exc) |
| gitlab | gitlab_ee | From 10.1.0 (inc) to 19.0.5 (exc) |
| gitlab | gitlab_ce | From 19.1 (inc) to 19.1.3 (exc) |
| gitlab | gitlab_ee | From 19.1 (inc) to 19.1.3 (exc) |
| gitlab | gitlab_ce | From 19.2 (inc) to 19.2.1 (exc) |
| gitlab | gitlab_ee | From 19.2 (inc) to 19.2.1 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
