CVE-2026-6277: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage project security configuration even when the relevant feature was in a disabled state, due to incorrect authorization enforcement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.10.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 18.11.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6277?
The severity of CVE-2026-6277 is rated as medium with a score of 4.3.
How do I fix CVE-2026-6277?
To fix CVE-2026-6277, upgrade GitLab EE to versions 18.10.8, 18.11.5, or 19.0.2 and above.
What software is affected by CVE-2026-6277?
CVE-2026-6277 affects GitLab EE versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2.
What type of vulnerability is CVE-2026-6277?
CVE-2026-6277 is an Incorrect Authorization vulnerability in GitLab.
Who can exploit CVE-2026-6277?
CVE-2026-6277 can potentially be exploited by an authenticated user with Security Manager-role permissions.