CVE-2026-5309

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.6 through 18.11.5 GitLab EE versions 19.0 through 19.0.2 GitLab EE versions 19.1 through 19.1.0

Description An authorization bypass exists that allows an authenticated user to read or modify the virtual registry cleanup policy settings of another group without proper authorization under certain conditions.

Recommendations Update GitLab EE versions 18.6 through 18.11.5 to version 18.11.6. Update GitLab EE versions 19.0 through 19.0.2 to version 19.0.3. Update GitLab EE versions 19.1 through 19.1.0 to version 19.1.1.