CVE-2026-5173

CVE-2026-5173 is an access control vulnerability affecting GitLab Community Edition and Enterprise Edition across multiple versions (16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3). The flaw allows authenticated users to invoke unintended server-side methods through websocket connections due to improper access control mechanisms. The vulnerability carries a CVSS score of 8.5 (HIGH) with a network-based attack vector requiring low complexity and low privileges. The attack requires an authenticated user but no user interaction, with potential consequences including high confidentiality impact and limited integrity impact across multiple systems. The network-based nature and low attack complexity indicate this could be exploited by most attackers with valid credentials. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00023 indicates this vulnerability ranks lower than most CVEs in terms of real-world exploitation probability, though organizations running affected GitLab versions should prioritize patching to prevent potential privilege escalation or lateral movement by authenticated threat actors.