# CVE-2026-6336: GitLab CE/EE incorrect authorization in project import status

Source: https://junglewise.ai/threats/cve-2026-6336-gitlab-ce-ee-incorrect-authorization-in-project-import-status  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-6336 · Severity: medium · CVSS 5.3 · Published 2026-07-29

GitLab, a platform for software development and version control, has addressed a security flaw that could allow unauthorized individuals to view sensitive information about project imports. An attacker could potentially see details regarding where a project was imported from, which may include internal source information. This issue affects self-managed GitLab Community and Enterprise editions, and users are advised to upgrade to the latest patched versions to protect their data.

Technologies: [GitLab](https://junglewise.ai/threats/technologies/gitlab). Vendors: [GitLab](https://junglewise.ai/threats/vendors/gitlab).

## Quick answers

**Is CVE-2026-6336 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6336 being exploited in the wild.

**How severe is CVE-2026-6336?** Medium severity, with a CVSS score of 5.3, published 29 July 2026.

**Which products and versions are affected?** GitLab 16.6 to 19.0.5, 19.1 to 19.1.3, 19.2 to 19.2.1.

**Is there a fix for CVE-2026-6336?** A patch was published on 2026-07-29: GitLab released versions 19.2.1, 19.1.3, and 19.0.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6336 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6336?** Check whether you run GitLab at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in GitLab CE/EE within the project import status functionality. The flaw is caused by a missing authorization check that allows an unauthenticated, remote attacker to view project import source information. This could lead to the disclosure of metadata or source details related to how projects were migrated into the instance. The issue affects versions 16.6 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1. GitLab has released patches in versions 19.0.5, 19.1.3, and 19.2.1 to address this vulnerability.

## Affected products

- GitLab GitLab CE/EE 16.6 to 19.0.5, 19.1 to 19.1.3, 19.2 to 19.2.1

## Timeline

- 2026-07-29: patched: GitLab released versions 19.2.1, 19.1.3, and 19.0.5.
- 2026-07-29: advisory: NVD published the CVE record.

## References

- [https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/)
- [https://gitlab.com/gitlab-org/gitlab/-/work_items/596762](https://gitlab.com/gitlab-org/gitlab/-/work_items/596762)
- [https://hackerone.com/reports/3661988](https://hackerone.com/reports/3661988)

## Related threats

- [GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and…](https://junglewise.ai/threats/cve-2026-9268-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all-versions)
- [GitLab CE/EE integer overflow in CI/CD regular expression compiler](https://junglewise.ai/threats/cve-2026-97229-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab EE prompt injection in AI agent instructions](https://junglewise.ai/threats/cve-2026-96893-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all)
- [GitLab Community Edition and Enterprise Edition cross-site scripting in syntax highlighting](https://junglewise.ai/threats/cve-2026-92883-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab EE incorrect authorization in merge request approval eligibility](https://junglewise.ai/threats/cve-2026-92528-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all)