CVEvulnerability
CVE-2026-3035
5.5 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-08-26
- Last modified
- 2026-08-31
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-288
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.
Affected configurations
• gitlab gitlab (>= 11.3.0 < 19.1.7)
• gitlab gitlab (>= 19.2.0 < 19.2.5)
• gitlab gitlab 19.3.0
Related
Weakness · CWE (1)
- CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/591189 Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/3529751 Permissions Required, Third Party Advisory