CVE-2026-1322

HighCVSS 8.1/10Last modified Nov 11, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-840

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.0, < 18.9.7; >= 18.10, < 18.10.6; >= 18.11, < 18.11.3

References

https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/Release Notes
https://gitlab.com/gitlab-org/gitlab/-/work_items/587270Not Applicable
https://hackerone.com/reports/3508895Permissions Required

Timeline

Published: May 14, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-132219.1Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression mat CVE-2026-132226.3Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a succe CVE-2026-132236.3Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a su CVE-2026-132244.9A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary fil CVE-2026-132255.3Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation p CVE-2026-132266.5The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' para CVE-2026-132277.1An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whiteli CVE-2026-132288.8The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administra CVE-2026-132297.1Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.CVE-2026-13238.8The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to e CVE-2026-132306.5An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes s CVE-2026-132316.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka