This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitLab CE/EE fixes 12 vulnerabilities

GitLab fixes 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.10.3, 18.9.5 and 18.8.9 [1]. The most severe vulnerabilities are listed below.

GitLab - improper access control (CVE-2026-5173)
CVSS 8.5 (High)

An authenticated remote attacker is able to invoke internal server functions due to a permissions flaw, which may lead to disclosure of sensitive data [1].

The vulnerability is present in products:

  • GitLab Community Edition; >=16.9.6, <18.8.9; >=18.9, <18.9.5; >=18.10, <18.10.3
  • GitLab Enterprise Edition; >=16.9.6, <18.8.9; >=18.9, <18.9.5; >=18.10, <18.10.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 8. 4. 2026.

GitLab - DoS (CVE-2026-1092)
CVSS 7.5 (High)

An unauthenticated remote attacker is able to carry out a DoS attack via the infrastructure state locking API due to insufficient validation of JSON inputs [1].

The vulnerability is present in products:

  • GitLab Community Edition; >=12.10, <18.8.9; >=18.9, <18.9.5; >=18.10, <18.10.3
  • GitLab Enterprise Edition; >=12.10, <18.8.9; >=18.9, <18.9.5; >=18.10, <18.10.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 8. 4. 2026.

GitLab - DoS (CVE-2025-12664 )
CVSS 7.5 (High)

An unauthenticated remote attacker is able to carry out a DoS attack by sending repeated requests to the data query interface [1].

The vulnerability is present in products:

  • GitLab Community Edition; >=13.0, <18.8.9; >=18.9, <18.9.5; >=18.10, <18.10.3
  • GitLab Enterprise Edition; >=13.0, <18.8.9; >=18.9, <18.9.5; >=18.10, <18.10.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 8. 4. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 9. 4. 2026.

CESNET, z.s.p.o. Logo