Report feedback

An authenticated remote attacker with the Developer role can, under certain conditions, gain unauthorized access to potentially sensitive information due to insufficient access control when processing internal requests in the Workhorse component [1][2].

The vulnerability is present in products:

• GitLab CE; >=10.1.0, <19.0.5; >= 19.1.0, < 19.1.3; >= 19.2.0, < 19.2.1;
• GitLab EE; >=10.1.0, <19.0.5; >= 19.1.0, < 19.1.3; >= 19.2.0, < 19.2.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2026-6267 at cve.org, NVD
• CWE-201: Insertion of Sensitive Information Into Sent Data at cwe.mitre.org

The vulnerability was publicly disclosed 29. 7. 2026.

An authenticated remote attacker can, under certain conditions, modify another user's CI/CD configuration due to insufficient validation of user attributes when processing input in the pipeline scheduling API [1][3].

The vulnerability is present in products:

• GitLab CE; >=18.0, <19.0.5; >=19.1, <19.1.3; >=19.2, <19.2.1;
• GitLab EE; >=18.0, <19.0.5; >=19.1, <19.1.3; >=19.2, <19.2.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

More information:

• CVE-2026-12436 at cve.org, NVD
• CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes at cwe.mitre.org

The vulnerability was publicly disclosed 29. 7. 2026.

An unauthenticated remote attacker can, under certain conditions, trigger a DoS due to insufficient resource limiting when processing Merge Request discussions [1][4].

The vulnerability is present in products:

• GitLab CE; >=11.8, <19.0.5; >=19.1, <19.1.3; >=19.2, <19.2.1;
• GitLab EE; >=11.8, <19.0.5; >=19.1, <19.1.3; >=19.2, <19.2.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2026-15975 at cve.org, NVD
• CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 29. 7. 2026.