{"affected":[{"conditional":false,"product":"gitlab","source":"NVD","vendor":"gitlab","versions":[{"greaterThanOrEqual":"18.2.0","lessThan":"18.9.6","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"gitlab","source":"NVD","vendor":"gitlab","versions":[{"greaterThanOrEqual":"18.10.0","lessThan":"18.10.4","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"gitlab","source":"NVD","vendor":"gitlab","versions":[{"status":"affected","version":"18.11.0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionEndExcluding":"18.9.6","versionStartIncluding":"18.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionEndExcluding":"18.9.6","versionStartIncluding":"18.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionEndExcluding":"18.10.4","versionStartIncluding":"18.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionEndExcluding":"18.10.4","versionStartIncluding":"18.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:community:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:enterprise:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-6515","cwes":["CWE-613"],"description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"NVD: cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794438600263,"publishedAt":1776878204923,"references":[{"source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"],"url":"https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/595993"}],"remediation":[],"revision":"975a189ba9f0f55e06ce142951458566ed97e42e291a5e4b94375e27b0fb1e1c","sources":[{"modifiedAt":1794438600263,"name":"NVD","retrievedAt":1794442727468,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6515"}],"ssvc":{"assessedAt":1776880248419,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2026-6515","updatedAt":1794442727468}