CVE-2026-3176: Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to access project information due to insufficient authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3176?
The severity of CVE-2026-3176 is classified as low with a score of 3.1.
How do I fix CVE-2026-3176?
To fix CVE-2026-3176, upgrade to GitLab EE version 18.11.6, 19.0.3, or 19.1.1 or later.
What software is impacted by CVE-2026-3176?
CVE-2026-3176 affects all versions of GitLab EE from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.
What type of vulnerability is CVE-2026-3176?
CVE-2026-3176 is a missing authorization vulnerability that allows limited access to project information.
Can an unauthenticated user exploit CVE-2026-3176?
No, an authenticated user with limited permissions can exploit CVE-2026-3176 due to insufficient authorization checks.