Loading vulnerability…
Improper authorization in GitLab EE repository mirroring credential access
CVE-2026-11827 is a medium-severity improper authorization vulnerability in GitLab Enterprise Edition affecting repository mirroring. It impacts all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. Under certain conditions, an authenticated user with maintainer-role permissions could obtain another user's stored credentials because authorization controls around access to repository mirroring credentials were insufficient. The flaw is rooted in improper authorization enforcement rather than memory corruption or injection, and it can expose credentials stored for mirroring operations to a user who should not be permitted to retrieve them.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose another user's stored credentials used in repository mirroring. Exposure of those credentials can enable unauthorized access to mirrored repositories or connected systems, facilitate privilege misuse, and create follow-on opportunities for lateral movement or compromise of associated accounts and services, depending on how the exposed credentials are scoped and reused.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting maintainer-role assignments to only fully trusted users, reviewing and minimizing use of stored repository mirroring credentials, rotating any credentials that may have been exposed, and monitoring repository mirroring administration and related access activity for anomalous credential access. These measures are temporary risk reductions and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 18.11.7 and later in the 18.11 series, 19.0.4 and later in the 19.0 series, and 19.1.2 and later in the 19.1 series. Self-managed deployments running affected versions should be updated immediately. GitLab.com was already patched, and GitLab Dedicated customers were reported as unaffected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.