CVE-2026-5173:
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.
Score
A numerical rating that indicates how dangerous this vulnerability is.
8.5HighA numerical rating that indicates how dangerous this vulnerability is.
- Published Date:Apr 8, 2026
- CISA KEV Date:*No Data*
- Industries Affected:20
Exploitability
- Score:3.1
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:LOW
- User Interaction:NONE
- Scope:CHANGED
Impact
- Score:4.7
- Confidentiality Impact:HIGH
- Integrity Impact:LOW
- Availability Impact:NONE
Description Preview
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
Low
