CVE-2026-2601: Missing Authorization in GitLab

Q: What is the severity of CVE-2026-2601?

CVE-2026-2601 has a medium severity rating of 4.3.

Q: What is the impact of CVE-2026-2601?

CVE-2026-2601 allows authenticated users with developer-role permissions to access sensitive deployment data.

Q: How do I fix CVE-2026-2601?

To fix CVE-2026-2601, upgrade to GitLab versions 18.10.7, 18.11.4, 19.0.1 or above.

Q: Which versions of GitLab are affected by CVE-2026-2601?

CVE-2026-2601 affects all GitLab EE versions starting from 11.5 and before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1.

Q: What type of vulnerability is CVE-2026-2601?

CVE-2026-2601 is classified as a missing authorization vulnerability.

Published May 27, 2026

Updated

GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to access sensitive deployment data on projects due to improper authorization checks.

Affected Software

4 affected components

GitLab GitLab EE>=11.5<18.10.7, >=18.11<18.11.4, >=19.0<19.0.1

GitLab GitLab>=11.5.0<18.10.7

GitLab GitLab>=18.11.0<18.11.4

GitLab GitLab=19.0.0

Remediation

Information

Upgrade to versions 18.10.7, 18.11.4, 19.0.1 or above.

Event History

May 27, 2026

CVE Published

via MITRE·05:55 PM

Data Sourced

via MITRE·05:55 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-2601?

CVE-2026-2601 has a medium severity rating of 4.3.

What is the impact of CVE-2026-2601?