CVE-2026-5262

CVE-2026-5262 is an authentication bypass vulnerability affecting GitLab Community Edition and Enterprise Edition versions 16.1.0 through 18.11.0, wherein improper input validation in the Storybook development environment allows unauthenticated attackers to access sensitive tokens under certain conditions. The vulnerability impacts multiple version branches, including 16.1.0-18.9.5, 18.10.0-18.10.3, and 18.11.0-18.11.0, with patches available in versions 18.9.6, 18.10.4, and 18.11.1 respectively. The vulnerability carries a CVSS severity score of 8.0 (HIGH) with a network-based attack vector requiring user interaction and medium attack complexity. While confidentiality and integrity impacts are rated as HIGH, the attack requires specific conditions to be met, as reflected in the CVSS vector AC:H parameter. The exposure of authentication tokens represents a significant risk, as compromised credentials could enable further lateral movement and unauthorized access to GitLab resources. Currently, this vulnerability shows no evidence of active exploitation in the wild, with an exceptionally low EPSS score of 0.00018 indicating minimal probability of exploitation. The vulnerability is not listed in the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists, suggesting the security community has not yet developed or widely distributed functional exploit code for this issue.