Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Unrated

Authorization Bypass in GitLab EE Virtual Registry Cleanup Policy API

IdentifiersCVE-2026-5309CWE-639

GitLab EE contains an authorization bypass vulnerability in the Virtual Registry Cleanup Policy API. According to the provided advisory, the issue affects all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1. Under certain conditions, an authenticated user could read or modify another group's virtual registry cleanup policy settings without authorization. The flaw is described as affecting access control enforcement for group-scoped virtual registry cleanup policy operations, allowing cross-group access to settings that should be restricted to authorized users of the target group.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could allow an authenticated attacker to bypass intended group-level authorization boundaries and access another group's virtual registry cleanup policy configuration. This may result in unauthorized disclosure of policy settings and unauthorized modification of those settings, creating both confidentiality and integrity impact. Depending on how the cleanup policy is used operationally, unauthorized changes could disrupt registry retention behavior or administrative control over package cleanup processes for the affected group.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by limiting access to authenticated accounts, especially untrusted or low-trust users who can interact with the Virtual Registry Cleanup Policy API. Monitor for unexpected reads or changes to virtual registry cleanup policy settings across groups, review audit logs for cross-group administrative actions, and temporarily restrict use of the affected API functionality where operationally feasible. These are compensating controls only; the primary mitigation is upgrading to a fixed version.

Remediation

Patch, then assume compromise.

Upgrade GitLab EE to a fixed release. The provided content states that GitLab remediated the issue in versions 18.11.6, 19.0.3, and 19.1.1. Affected self-managed deployments should upgrade to one of these patched versions or later. GitLab.com was already patched at the time of the advisory.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.