This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 15 vulnerabilities
GitLab fixes 15 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 18.8.4, 18.7.4 and 18.6.6 [1]. The most severe vulnerabilities are listed below.
An unauthenticated remote attacker can gain unauthorized access to private repositories using a stolen authentication token [1].
The vulnerability is present in product:
- GitLab; >=18.8.0, <18.8.4; >=18.7.0, <18.7.4; >=18.2.0, <18.6.6;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2025-7659 at cve.org, NVD
- CWE-346: Origin Validation Error at cwe.mitre.org
The vulnerability was publicly disclosed 10. 2. 2026.
An unauthenticated remote attacker can carry out a DoS attack by repeatedly sending GrapQL queries [1].
The vulnerability is present in product:
- GitLab; >=18.8.0, <18.8.4; >=18.7.0, <18.7.4; >=10.8.0, <18.6.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-8099 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 10. 2. 2026.
Under certain circumstances, an authenticated remote attacker can carry out an XSS attack in the Code Flow functionality in the vulnerability detail [1].
The vulnerability is present in product:
- GitLab; >=18.8.0, <18.8.4; >=18.7.0, <18.7.4; >=17.1.0, <18.6.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
More information:
- CVE-2025-14560 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 2. 2026.
By CESNET, z.s.p.o. Martin Krajči on 12. 2. 2026.