Medium · 4.3 CVE-2026-8144 EUVD-2026-30241GHSA-c73g-r4cp-2xmg

Missing Authorization in GitLab

Published May 14, 2026 · Updated May 14, 2026 · Assigned by GitLab

Vendor: GitLab Product: GitLab Package: gitlab Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-agent-18.8 Package: gitlab-docker-machine-18.10 Package: gitlab-docker-machine-18.6 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-kas-18.8 Package: gitlab-pages-18.11 Package: gitlab-pages-18.6 Package: gitlab-pages-18.7 Package: gitlab-pages-18.8 Package: gitlab-runner-18.10 Package: gitlab-runner-18.6 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.6 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitlab-runner-helper-compat-18.10 Package: gitlab-runner-helper-compat-18.6 Package: gitlab-runner-helper-compat-18.7 Package: gitlab-runner-helper-compat-18.8 Package: gitlab-runner-helper-compat-18.9 Package: gitlab-runner-helper-oci-entrypoint-18.10 Package: gitlab-runner-helper-oci-entrypoint-18.6 Package: gitlab-runner-helper-oci-entrypoint-18.7 Package: gitlab-runner-helper-oci-entrypoint-18.8 Package: gitlab-runner-helper-oci-entrypoint-18.9 Package: gitlab-runner-oci-entrypoint-18.10 Package: gitlab-runner-oci-entrypoint-18.6 Package: gitlab-runner-oci-entrypoint-18.7 Package: gitlab-runner-oci-entrypoint-18.8 Package: gitlab-runner-oci-entrypoint-18.9 Category: Web / CMS Ecosystem: Ubuntu Ecosystem: Wolfi

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.

Affected products

Vendor	Product	Affected	Fixed
GitLab	GitLab	15.1 – < 18.9.7, 18.10 – < 18.10.6, 18.11 – < 18.11.3	18.9.7

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	gitlab	No fix yet	—

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	gitlab-kas-18.6 +38	No fix yet	—
Wolfi rolling	gitlab-pages-18.11	18.11.3-r0	—

Advisories 2

NCSC-2026-0161 Kwetsbaarheden verholpen in GitLab door GitLab Inc. NCSC-NL (Netherlands) · May 15, 2026
WID-SEC-2026-1523 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2026

References