CVE-2026-5796

score

<0.1

cvss

4.3

epss

0.4%

published

2026-06-25

kev added

—

first seen

2026-10-21

GitLab CE/EE >= 13.6 < 18.11.6, 19.0 < 19.0.3, and 19.1 < 19.1.1 contain an information disclosure caused by incorrect authorization checks in the group packages feature, letting authenticated users with Reporter-level group permissions view package metadata from projects with Package Registry disabled, exploit requires Reporter-level group permissions.