CVE-2026-5262

MediumCVSS 6.1/10Last modified Nov 11, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.1.0, < 18.9.6; >= 18.10, < 18.10.4; >= 18.11, < 18.11.1

References

https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/595332Broken Link
https://hackerone.com/reports/3574642Permissions Required

Timeline

Published: Apr 22, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-526227.5An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows CVE-2026-52636.5URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn CVE-2026-526309.8SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the CVE-2026-52649.8Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buff CVE-2026-52656.5When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICM CVE-2026-526569.8An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute a CVE-2026-52662.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated wi CVE-2026-52677.5Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly CVE-2026-526736.5SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues comp CVE-2026-52689.1An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerabi CVE-2026-526809.8Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. CVE-2026-526813.1Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly