CVE-2026-5173 - Vulnerability Analysis

Overview

GitLab CE/EE >= 16.9.6 < 18.8.9, 18.9 < 18.9.5, and 18.10 < 18.10.3 contain a broken access control vulnerability caused by improper access control in websocket connections, letting authenticated users invoke unintended server-side methods.

Severity & Score

Impact

Authenticated users can invoke unintended server-side methods, potentially leading to unauthorized actions or data access.

Mitigation

Update to GitLab CE/EE 18.8.9, 18.9.5, 18.10.3 or later.

References

• https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/
• https://gitlab.com/gitlab-org/gitlab/-/work_items/588959

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner