CVE-2026-1747

MEDIUM

GitLab 17.11-18.7.4, 18.8-18.8.4, 18.9-18.9.0 - Authenticated Privilege Escalation via Conan Package Modification

Title source: llm

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.

References (3)

Core 3

Core References

Release Notes

https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/

Issue Tracking issue-tracking permissions-required

https://gitlab.com/gitlab-org/gitlab/-/issues/588385

Third Party Advisory technical-description exploit permissions-required

https://hackerone.com/reports/3533088

Scores

CVSS v3 4.3

EPSS 0.0023

EPSS Percentile 13.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-288

Status published

Products (2)

gitlab/gitlab 18.9.0 (2 CPE variants)

gitlab/gitlab 17.11.0 - 18.7.5 (2 CPE variants)

Published Feb 25, 2026

Tracked Since Feb 26, 2026