CVE-2026-6277

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage project security configuration even when the relevant feature was in a disabled state, due to incorrect authorization enforcement.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-627707.8Heap-based buffer overflow in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-627717.8Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-627727.8Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privilegesCVE-2026-627737.0Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.CVE-2026-627747.0Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-627755.5Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information CVE-2026-627767.8Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges loCVE-2026-627777.8Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally.CVE-2026-627788.1Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network.CVE-2026-627797.8Use after free in Windows Schannel allows an authorized attacker to elevate privileges locally.CVE-2026-627807.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-627818.1Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network.
CVE-2026-6277: Medium severity, CVSS 4.3 | Vulnix