Improper Authentication in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-4363
Published: March 25, 2026 / Updated: March 26, 2026
Vulnerability identifier: #VU124609
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-4363
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to resources.
The vulnerability exists due to improper caching of authorization decisions in authorization caching when handling requests under certain conditions. A remote user can send a specially crafted request to exploit stale or incorrect authorization cache entries and gain unauthorized access to resources.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-4363
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 18.8.7, 18.9.3, 18.10.1
Gitlab Community Edition - addressed in versions 18.8.7, 18.9.3, 18.10.1
Gitlab Community Edition - addressed in versions 18.8.7, 18.9.3, 18.10.1