PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1338 Hackerone CVE debrief

CVE-2026-1338 is a medium-severity authorization issue in GitLab CE/EE. According to the advisory text, an authenticated user with developer-role permissions could delete protected container registry tags because of improper authorization checks. The affected ranges are GitLab 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. The issue is recorded with CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

Vendor
Hackerone
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-14
Advisory published
2026-05-14
Advisory updated
2026-05-14

Who should care

GitLab administrators and platform owners running CE/EE, especially environments that rely on protected container registry tags and delegate developer-role access to users or teams.

Technical summary

The vulnerability is described as an authorization bypass (CWE-639) affecting protected container registry tags in GitLab CE/EE. An authenticated user with developer-role permissions could delete tags that should have been protected, indicating insufficient authorization enforcement around tag deletion actions. The advisory lists no confidentiality or availability impact, with the primary impact being integrity.

Defensive priority

Medium. This is not marked as KEV and the reported impact is limited to integrity, but it affects common GitLab deployment patterns where registry tag protection is used to preserve release artifacts.

Recommended defensive actions

  • Upgrade GitLab CE/EE to a fixed release: 18.9.7 or later, 18.10.6 or later, or 18.11.3 or later, depending on your branch.
  • Confirm that protected container registry tag rules are enabled and still aligned with your access-control model.
  • Review developer-role assignments for GitLab instances that expose container registry management to multiple users.
  • Audit recent container registry tag deletion activity and investigate any unexpected deletions.
  • Track the GitLab patch release advisory and related reference items for any follow-up guidance.

Evidence notes

The debrief is based on the GitHub Advisory Database entry for GHSA-8h74-p4xx-m53m, which cites the NVD record, a HackerOne report (3480620), the GitLab 18.11.3 patch-release announcement, and a GitLab work item. The source item is marked advisoryType=unreviewed, so claims are limited to the advisory text and referenced records.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-1338 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-1338

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-1338 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-1338

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://github.com/advisories/GHSA-8h74-p4xx-m53m

    github_advisory_database

  • Source reference

    Unverified legacy reference

    URL: https://hackerone.com/reports/3480620

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://gitlab.com/gitlab-org/gitlab/-/work_items/587326

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.