CVE-2026-3073: Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.9.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.10.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3073?
CVE-2026-3073 has a medium severity level due to its potential to allow unauthorized access for users with developer-role permissions.
How do I fix CVE-2026-3073?
To mitigate CVE-2026-3073, upgrade GitLab CE or EE to version 18.11.3 or later.
What versions are affected by CVE-2026-3073?
CVE-2026-3073 affects GitLab CE/EE versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.
What kind of vulnerability is CVE-2026-3073?
CVE-2026-3073 is an authorization bypass vulnerability that can be exploited through user-controlled keys.
Who is impacted by CVE-2026-3073?
Authenticated users with developer-role permissions in GitLab are primarily impacted by CVE-2026-3073.