CVE-2026-3073

MediumCVSS 4.3/10Last modified Nov 11, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 17.6, < 18.9.7; >= 18.10, < 18.10.6; >= 18.11, < 18.11.3

References

https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/Release Notes
https://gitlab.com/gitlab-org/gitlab/-/work_items/591227Not Applicable
https://hackerone.com/reports/3532563Permissions Required

Timeline

Published: May 14, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-30744.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.CVE-2026-307419.8A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Si CVE-2026-30755.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Jeff Starr Simple Ajax Chat simple-ajax-chat all CVE-2026-307548.8A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264 CVE-2026-307607.3An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a craft CVE-2026-307617.3An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to CVE-2026-307697.8An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via s CVE-2026-307776.5EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid CVE-2026-307787.5The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apa CVE-2026-307839.8A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API CVE-2026-307855.5Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computatio CVE-2026-307899.8Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rust