CVE-2026-114466 PUBLISHED

Insufficient Granularity of Access Control in Git

Assigner: GitLab
Reserved: 21.10.2026 Published: 12.11.2026 Updated: 12.11.2026

Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS Score: 4.4

Product Status

Vendor Git
Product Git
Versions Default: unknown
  • Version 2.50.1 is affected
  • Version 2.51.2 is affected
  • Version 2.52.0 is affected
  • Version 2.53.0 is affected
  • Version 2.54.0 is affected
  • Version 2.55.0 is affected
  • Version 2.56.0 is affected

Solutions

Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above.

Credits

  • ehdgks0627, un3xploitable finder

References

Problem Types

  • CWE-1220: Insufficient Granularity of Access Control CWE