CVE-2026-6976 LOW

CVE-2026-6976: Authorization Bypass Through User-Controlled Key in GitLab

Vendor Gitlab

Product GitLab

Weakness CWE-639 · IDOR

Published June 11, 2026

Last update June 11, 2026

View on NVD All CVEs

CVSS base score

3.7/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to hide changes from merge request diff views due to improper input handling of file names.

Key dates

02Disclosure timeline

June 11, 2026 CVE published

June 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-6976 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Identifiers

CVE CVE-2026-6976

CWE CWE-639

CVSS 3.7 / LOW

Affected versions

Vendor Gitlab

Product GitLab

Affected ≥ 15.9 and < 18.10.8

Vendor Gitlab

Product GitLab

Affected ≥ 18.11 and < 18.11.5

Vendor Gitlab

Product GitLab

Affected ≥ 19.0 and < 19.0.2