CVE-2026-11379

EUVD-2026-39170
GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitLabCNA
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
gitlabgitlab
13.11 ≤
𝑥
< 18.11.6
CNA
gitlabgitlab
19.0 ≤
𝑥
< 19.0.3
CNA
gitlabgitlab
19.1 ≤
𝑥
< 19.1.1
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/517659