CVE-2026-1747

MEDIUM

GitLab EE - Privilege Escalation

Title source: llm

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.

References (3)

[Release Notes] https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/

[Issue Tracking] https://gitlab.com/gitlab-org/gitlab/-/issues/588385

[Third Party Advisory] https://hackerone.com/reports/3533088

Scores

CVSS v3 4.3

EPSS 0.0001

EPSS Percentile 1.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-288

Status published

Affected Products (4)

gitlab/gitlab < 18.7.5

gitlab/gitlab

Timeline

Published Feb 25, 2026

Tracked Since Feb 26, 2026