CVE-2026-6713: GitLab Auth Bypass Vulnerability

CVE-2026-6713 Overview

CVE-2026-6713 is an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows unauthorized users to enumerate private projects. The issue stems from incorrect authorization checks and is classified under [CWE-863]: Incorrect Authorization. Affected versions include GitLab 18.2 through 18.10.6, 18.11 through 18.11.3, and 19.0.0. GitLab patched the issue in versions 18.10.7, 18.11.4, and 19.0.1. The vulnerability is exploitable over the network without authentication or user interaction, but it only impacts confidentiality with no integrity or availability effects.

Critical Impact

Unauthorized network attackers can enumerate the existence of private GitLab projects, leaking organizational metadata that supports targeted follow-on attacks.

Affected Products

• GitLab CE/EE versions 18.2 through 18.10.6
• GitLab CE/EE versions 18.11 through 18.11.3
• GitLab CE/EE version 19.0.0

Discovery Timeline

• 2026-05-27 - GitLab releases patch versions 18.10.7, 18.11.4, and 19.0.1
• 2026-05-27 - CVE-2026-6713 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-6713

Vulnerability Analysis

The vulnerability resides in GitLab's authorization layer, where access control checks fail to correctly verify whether a requesting user has permission to view metadata for private projects. Under specific conditions, the application returns information that confirms or denies the existence of a private project to a user who should not have visibility into that resource.

Project enumeration weaknesses are valuable to attackers performing reconnaissance against software supply chains. Knowing the names and existence of private repositories gives attackers a list of targets for credential stuffing, social engineering, and dependency confusion attacks. The flaw does not expose source code or repository contents directly, which limits the impact to confidentiality of project metadata.

Root Cause

The root cause is an incorrect authorization check [CWE-863] in a code path that handles project lookups or listings. The check failed to consistently enforce visibility rules for private projects, allowing unauthorized callers to infer project existence. GitLab documented the underlying fix in GitLab Work Item #597490.

Attack Vector

An unauthenticated remote attacker sends crafted requests to GitLab endpoints that handle project resolution. By observing differences in responses, status codes, or behavior, the attacker determines whether a given private project exists. No privileges or user interaction are required, and the attack is fully network-based. Additional technical details are available in HackerOne Report #3644605.

Detection Methods for CVE-2026-6713

Indicators of Compromise

• High-volume sequential requests to project-related API endpoints or web routes from a single client or IP range
• Unauthenticated or low-privilege sessions probing project paths that should return generic 404 responses
• Repeated requests against /api/v4/projects/ and similar endpoints with varying project identifiers or names

Detection Strategies

• Review GitLab production logs (production_json.log, api_json.log) for unauthenticated requests targeting project endpoints with abnormal frequency
• Correlate request patterns against user authentication state to flag enumeration attempts from anonymous sessions
• Apply rate-limiting alerts on project lookup endpoints to surface scripted enumeration activity

Monitoring Recommendations

• Forward GitLab application and audit logs to a centralized SIEM or data lake for retention and behavioral analytics
• Alert on anomalous spikes in 200 versus 404 response ratios on project endpoints from a single source
• Track and review access patterns to private projects, especially from IPs outside known administrative ranges

How to Mitigate CVE-2026-6713

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.10.7, 18.11.4, or 19.0.1 depending on your release branch
• Audit access logs from the introduction of GitLab 18.2 onward for signs of project enumeration activity
• Restrict network exposure of self-managed GitLab instances to trusted networks and VPNs where feasible

Patch Information

GitLab addressed the issue in the May 27, 2026 patch release. Details are documented in the GitLab Patch Release 19.0.1 advisory. All self-managed administrators should upgrade promptly, and GitLab.com instances are already patched by GitLab.

Workarounds

• No official workaround exists; upgrading to a fixed version is the only complete remediation
• Limit unauthenticated access to GitLab where possible by enforcing sign-in for public-facing instances
• Apply network-level access controls and Web Application Firewall (WAF) rules to throttle enumeration patterns against project endpoints

# Verify GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# For Omnibus installations, upgrade via package manager
sudo apt-get update && sudo apt-get install gitlab-ee=19.0.1-ee.0
# or for CE
sudo apt-get install gitlab-ce=19.0.1-ce.0