{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-22T21:13:04.773","vulnerabilities":[{"cve":{"id":"CVE-2026-1663","sourceIdentifier":"cve@gitlab.com","published":"2026-03-11T16:16:22.833","lastModified":"2026-06-17T10:16:16.510","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in the group import process under certain circumstances."},{"lang":"es","value":"GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 14.4 anterior a la 18.7.6, la 18.8 anterior a la 18.8.6 y la 18.9 anterior a la 18.9.2 que podría haber permitido a un usuario autenticado con permisos de importación de grupo crear etiquetas en proyectos privados debido a una validación de autorización incorrecta en el proceso de importación de grupo bajo ciertas circunstancias."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"14.4","lessThan":"18.7.6","versionType":"semver","status":"affected"},{"version":"18.8","lessThan":"18.8.6","versionType":"semver","status":"affected"},{"version":"18.9","lessThan":"18.9.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-12T16:15:24.947201Z","id":"CVE-2026-1663","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"14.4.0","versionEndExcluding":"18.7.6","matchCriteriaId":"928EA20E-7DD4-4E96-ABDD-4D0C8C174BA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"14.4.0","versionEndExcluding":"18.7.6","matchCriteriaId":"D0F24E02-80E9-4CD5-84DF-8D7E93B74CE5"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"18.8.0","versionEndExcluding":"18.8.6","matchCriteriaId":"B703CB01-7F6D-4D6E-AE88-CF2F8012CA27"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.8.0","versionEndExcluding":"18.8.6","matchCriteriaId":"2B1F834B-A628-4894-A531-1A2A60DD58D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"18.9.0","versionEndExcluding":"18.9.2","matchCriteriaId":"44EAE9A6-5ED9-42F6-9BBD-0E2F8072F0D9"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.9.0","versionEndExcluding":"18.9.2","matchCriteriaId":"12A2DEC0-C471-4C98-960C-405209403AB9"}]}]}],"references":[{"url":"https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/","source":"cve@gitlab.com","tags":["Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/588207","source":"cve@gitlab.com","tags":["Broken Link"]},{"url":"https://hackerone.com/reports/3485548","source":"cve@gitlab.com","tags":["Permissions Required"]}]}}]}