CVE-2026-3607

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.

Scoring

Severity

MEDIUM

CVSS base score

4.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS probability

0.23%

CWE

CWE-1280

Published

2026-05-14

Last modified

2026-05-14

Affected products

• GitLab GitLab
• GitLab GitLab
• GitLab GitLab

Weakness type

• CWE-1280

Related vulnerabilities

• CVE-2026-7487 — Access Control Check Implemented After Asset is Accessed in GitLab

Markdown version · Browse all CVEs