CVE-2026-6567

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-656717.8Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.CVE-2026-656727.8Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.CVE-2026-656737.8Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges over a network.CVE-2026-656748.8Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-656756.5No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a netwoCVE-2026-656787.0Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-656798.1Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.CVE-2026-65687.3A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/CVE-2026-656806.7Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locCVE-2026-656817.5Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network.CVE-2026-656879.8Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature thCVE-2026-656889.8Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature t
CVE-2026-6567: Medium severity, CVSS 4.3 | Vulnix