GitLab CE/EE fixes 11 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitLab CE/EE fixes 11 vulnerabilities

GitLab fixes 11 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.11.1, 18.10.4 and 18.9.6 [1]. The most severe vulnerabilities are listed below.

GitLab CE/EE - CSRF (CVE-2026-4922)

CVSS 8.1 (High)

An unauthenticated remote attacker is able to carry out a CSRF attack within the GraphQL API, allowing them to make changes on behalf of logged-in users [1].

The vulnerability is present in products:

GitLab Community Edition; >=17.0, <18.9.6; >=18.10.0, <18.10.4; >=18.11.0, <18.11.1
GitLab Enterprise Edition; >=17.0, <18.9.6; >=18.10.0, <18.10.4; >=18.11.0, <18.11.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

More information:

CVE-2026-4922 at cve.org, NVD
CWE-352: Cross-Site Request Forgery (CSRF) at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2026.

GitLab CE/EE - XSS (CVE-2026-5816)

CVSS 8.0 (High)

An unauthenticated remote attacker is able to execute arbitrary JavaScript in the user's browser due to improper validation of file paths [1].

The vulnerability is present in products:

GitLab Community Edition; >=18.10.0, <18.10.4; >=18.11.0, <18.11.1
GitLab Enterprise Edition; >=18.10, <18.10.4; >=18.11, <18.11.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

More information:

CVE-2026-5816 at cve.org, NVD
CWE-41: Improper Resolution of Path Equivalence at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2026.

GitLab CE/EE - XSS (CVE-2026-5262)

CVSS 8.0 (High)

An unauthenticated remote attacker is able to access security tokens due to improper input validation in the development environment, which may lead to an XSS attack [1].

The vulnerability is present in products:

GitLab Community Edition; >=16.1.0, <18.9.6; >=18.10.0, <18.10.4; >=18.11.0, <18.11.1
GitLab Enterprise Edition; >=16.1.0, <18.9.6; >=18.10.0, <18.10.4; >=18.11.0, <18.11.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

More information:

CVE-2026-5262 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 22. 4. 2026.

Report feedback

[TLP:CLEAR] GitLab CE/EE fixes 11 vulnerabilities

GitLab CE/EE - CSRF (CVE-2026-4922)

CVSS 8.1 (High)

GitLab CE/EE - XSS (CVE-2026-5816)

CVSS 8.0 (High)

GitLab CE/EE - XSS (CVE-2026-5262)

CVSS 8.0 (High)

Links