GitLab EE contained an authorization bypass vulnerability identified as CVE-2026-5309 affecting versions >=18.6.0 <18.11.6, >=19.0.0 <19.0.3, and >=19.1.0 <19.1.1. Under certain conditions, an authenticated user could exploit this flaw to access or alter virtual registry cleanup policy settings of groups they should not have permission to manage. The vulnerability has been fixed in versions 18.11.6, 19.0.3, and 19.1.1.

An authenticated user could read or modify another group's virtual registry cleanup policy settings without authorization, potentially leading to unauthorized configuration changes affecting registry cleanup behavior within GitLab groups.

Upgrade GitLab EE to version 18.11.6 or later if running a version in the 18.6 to 18.11.5 range, to 19.0.3 or later if running a 19.0.x version prior to 19.0.3, or to 19.1.1 or later if running 19.1.0. These versions contain the official fix for this authorization bypass vulnerability.