MEDIUM

CVE-2026-6515

Gitlab GitLab 2026-04-22 CVSS v3.1

CVSS

5.4

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.

Summary dbcve.org

GitLab CE/EE versions 18.2 through 18.9.5, 18.10.0-18.10.3, and 18.11.0 contained a vulnerability where users could use invalidated or incorrectly scoped credentials to access Virtual Registries due to improper credential validation in the registry access control logic.

Mitigation

Upgrade GitLab to version 18.9.6, 18.10.4, or 18.11.1 or later to remediate this vulnerability.

Weakness (CWE)

CWE-613

EPSS Score

0.16%

Probability of exploitation in next 30 days

5.9th percentile

References

https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/work_items/595993 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE