CVE-2026-5309 Overview
CVE-2026-5309 is an authorization bypass vulnerability in GitLab Enterprise Edition (EE). The flaw allows an authenticated user to read or modify another group's virtual registry cleanup policy settings without proper authorization. The issue is categorized as [CWE-639] Authorization Bypass Through User-Controlled Key, commonly referred to as an Insecure Direct Object Reference (IDOR).
The vulnerability affects GitLab EE versions 18.6 through 18.11.5, 19.0 through 19.0.2, and 19.1.0. Exploitation requires network access and low privileges, with no user interaction needed. GitLab addressed the issue across affected branches in patch releases.
Critical Impact
An authenticated GitLab user can access and tamper with virtual registry cleanup policies belonging to groups they do not own, potentially disrupting artifact lifecycle management across tenants.
Affected Products
- GitLab EE versions 18.6 up to but not including 18.11.6
- GitLab EE versions 19.0 up to but not including 19.0.3
- GitLab EE versions 19.1 up to but not including 19.1.1
Discovery Timeline
- 2026-06-25 - CVE-2026-5309 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-5309
Vulnerability Analysis
The vulnerability resides in GitLab EE's virtual registry cleanup policy controller. Virtual registries aggregate package sources and apply cleanup policies that govern artifact retention. The cleanup policy endpoints failed to verify that the requesting user had authorization for the target group's registry.
An authenticated user can supply a group or registry identifier that does not belong to them. The application returns the policy settings or accepts modifications without enforcing group-scoped access control. This results in cross-tenant exposure of configuration data and unauthorized modification of retention rules.
The weakness maps to [CWE-639], where access decisions rely on a user-controlled identifier rather than a verified authorization check.
Root Cause
The root cause is missing object-level authorization in the virtual registry cleanup policy controller. The endpoint trusted the supplied resource identifier without validating membership or role on the parent group. Authentication alone was sufficient to reach the policy logic.
Attack Vector
The attack vector is network-based and requires an authenticated GitLab account on the target instance. The attacker issues authenticated API requests referencing a victim group's virtual registry. The server processes the request and either returns the policy or applies the requested changes. No social engineering or elevated privileges are required.
No verified proof-of-concept code is published. Refer to the GitLab Work Item #595468 and HackerOne Report #3628793 for additional technical context.
Detection Methods for CVE-2026-5309
Indicators of Compromise
- Unexpected modifications to virtual registry cleanup policy settings without a corresponding owner-initiated change request.
- API access logs showing authenticated requests to virtual registry cleanup policy endpoints from users who are not members of the target group.
- Audit log entries referencing cleanup policy create, read, or update actions performed by users outside the resource group hierarchy.
Detection Strategies
- Review GitLab production logs and audit events for requests to virtual registry cleanup policy routes correlated against the requester's group membership.
- Compare cleanup policy change events with project and group ownership metadata to surface cross-group access.
- Alert on API responses where the authenticated principal's namespace does not match the namespace of the queried virtual registry resource.
Monitoring Recommendations
- Enable and forward GitLab audit events and API access logs to a centralized logging platform for retention and query.
- Build dashboards focused on virtual registry administrative actions, segmented by group ID and actor.
- Establish a baseline of normal cleanup policy modification frequency per group and alert on deviations.
How to Mitigate CVE-2026-5309
Immediate Actions Required
- Upgrade GitLab EE to version 18.11.6, 19.0.3, or 19.1.1, depending on the deployed branch.
- Audit recent changes to virtual registry cleanup policies across all groups and revert unauthorized modifications.
- Review API tokens and active sessions for accounts that performed cross-group registry access.
Patch Information
GitLab released fixed versions 18.11.6, 19.0.3, and 19.1.1. Self-managed administrators should follow the upgrade guidance in the GitLab Patch Release Notes. GitLab.com instances are already patched by the vendor.
Workarounds
- No vendor-supplied workaround is documented; upgrading is the supported remediation path.
- Restrict creation of new user accounts on affected self-managed instances until the patch is applied.
- Limit network exposure of the GitLab API to trusted networks where feasible to reduce the population of potential abusers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
