CVE-2026-1747: Authentication Bypass Using an Alternate Path or Channel in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.
Other sources
GitLab has remediated an issue that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-1747?
CVE-2026-1747 has been classified as a high-severity improper access control vulnerability.
How do I fix CVE-2026-1747?
To remediate CVE-2026-1747, upgrade GitLab EE to versions 18.7.5, 18.8.5, or 18.9.1.
Which GitLab versions are affected by CVE-2026-1747?
CVE-2026-1747 affects GitLab EE versions from 17.11 up to but not including 18.7.5, 18.8 up to but not including 18.8.5, and 18.9 up to but not including 18.9.1.
Can Developer-role users exploit CVE-2026-1747?
Yes, under certain conditions, Developer-role users may exploit CVE-2026-1747 due to improper access control.
Is CVE-2026-1747 specific to any GitLab product?
CVE-2026-1747 specifically affects the GitLab EE product line.