This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 12 vulnerabilities
GitLab fixes 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.10.1, 18.9.3 and 18.8.7 [1]. The most severe vulnerabilities are listed below; the remaining ones can be found at [1].
Allows an authenticated remote attacker with minimal permissions in a workspace, due to an insufficient authorization check in Jira Connect installations in GitLab CE/EE, to obtain installation credentials and impersonate the GitLab application [1].
The vulnerability is present in products:
- GitLab Community Edition; >=14.3, <18.8.7; >=18.9, <18.9.3; >=18.10, <18.10.1
- GitLab Enterprise Edition; >=14.3, <18.8.7; >=18.9, <18.9.3; >=18.10, <18.10.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-2370 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
Allows an unauthenticated remote attacker, due to insufficient CSRF protection in the GraphQL API in GitLab CE/EE, to perform arbitrary GraphQL mutations on behalf of authenticated users [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.10, <18.8.7; >=18.9, <18.9.3; >=18.10, <18.10.1
- GitLab Enterprise Edition; >=17.10, <18.8.7; >=18.9, <18.9.3; >=18.10, <18.10.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
More information:
- CVE-2026-3857 at cve.org, NVD
- CWE-352: Cross-Site Request Forgery (CSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
Allows an authenticated remote attacker, due to insufficient sanitization of HTML content in the vulnerability report in GitLab EE, to add email addresses to targeted user accounts [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=15.4, <18.8.7; >=18.9, <18.9.3; >=18.10, <18.10.1
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-2995 at cve.org, NVD
- CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
Allows an unauthenticated remote attacker to carry out a DoS attack due to insufficient input validation when processing GraphQL requests in the GraphQL API in GitLab CE/EE [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.5, <18.8.7; >=18.9, <18.9.3; >=18.10, <18.10.1
- GitLab Enterprise Edition; >=18.5, <18.8.7; >=18.9, <18.9.3; >=18.10, <18.10.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-3988 at cve.org, NVD
- CWE-407: Inefficient Algorithmic Complexity at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
By CESNET, z.s.p.o. Michaela Jarošová on 26. 3. 2026.