CVE-2026-10518

4.3 MEDIUM

Published 2026-09-29 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-863

All references

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/601723
https://hackerone.com/reports/3686230

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100371PoC
UNSCOREDCVE-2026-100392PoC
MEDIUMCVE-2026-100529PoC
HIGHCVE-2026-100530PoC
HIGHCVE-2026-100535PoC
MEDIUMCVE-2026-100538PoC
LOWCVE-2026-100539PoC
MEDIUMCVE-2026-100540PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.