CVE-2026-11379

MEDIUM 5.3

Published 2026-06-25 · Last modified 2026-06-25

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 9th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

5.3CVSS 3.1 · MEDIUM

ConfidentialityHigh
IntegrityNone
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Gitlab

Products Gitlab

Weakness (CWE)

CWE-863: Incorrect authorization

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Technical & other

Sources: NVD · CVE.org · EPSS