A vulnerability in GitLab CE/EE allows authenticated users to trigger unauthorized server-side methods, posing a high risk of system manipulation.

The software fails to properly restrict access to server-side methods accessible through websocket connections, allowing an authenticated user to perform unauthorized actions. This is categorized as an exposed dangerous method or function (CWE-749).

The ability for an authenticated user to invoke unauthorized methods can lead to unauthorized data access, integrity compromise, or potential escalation of privileges within the GitLab environment. Given the CVSS score of 8.5, this high-severity vulnerability could facilitate significant operational disruption or the compromise of sensitive source code and CI/CD pipelines.

Immediate Action: Upgrade GitLab CE/EE instances to versions 18.8.9, 18.9.5, 18.10.3, or later as specified by the vendor.

Proactive Monitoring: Review websocket traffic and application logs for anomalous method calls or unexpected patterns originating from authenticated user sessions.

Compensating Controls: Implement strict network access controls and utilize a Web Application Firewall (WAF) to filter websocket traffic if immediate patching is not feasible.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/0xBlackash/CVE-2026-5173).

Due to the high CVSS severity and the presence of a public proof-of-concept, this vulnerability should be prioritized for immediate remediation. Organizations must apply the provided security patches to all affected GitLab instances to prevent potential exploitation of server-side methods by authenticated users.