CVE-2026-5173 Exposed Dangerous Method or Function in GitLab

High 8.5 Published 8 Apr 2026 Updated 9 Apr 2026

Authenticated users can invoke unintended server-side methods via websockets due to improper access control, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-5173?

CVE-2026-5173 is a high-severity missing authorization vulnerability in Gitlab Gitlab, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

Weakness: CWE-749

Which versions are affected by CVE-2026-5173?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `16.9.6`	`18.8.9, 18.9.5, 18.10.3`

Products include Gitlab Gitlab.

How do I fix CVE-2026-5173?

Upgrade gitlab to a fixed version for your release line: 18.8.9, 18.9.5 or 18.10.3.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-5173 being exploited?

There is no known exploitation of CVE-2026-5173 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2026-5173, GHSA-5gj7-3j23-w2h2, UBUNTU-CVE-2026-5173.