This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 25 vulnerabilities
GitLab fixes 25 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.11.3, 18.10.6 and 18.9.7. The most severe of them can be found below, the rest at [1].
An authenticated remote attacker with the developer role can carry out an XSS attack when analytics dashboards are rendered in GitLab EE [2].
The vulnerability is present in product:
- GitLab; >=16.4.0, <18.9.7; >=18.10.0, <18.10.6; >=18.11.0, <18.11.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-7481 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 5. 2026.
An authenticated remote attacker can carry out an XSS attack in the Duo Agent Platform in GitLab EE [3].
The vulnerability is present in product:
- GitLab; >=18.7.0, <18.9.7; >=18.10.0, <18.10.6; >=18.11.0, <18.11.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-6073 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 5. 2026.
An authenticated remote attacker can carry out an XSS attack in customizable analytics dashboards in GitLab EE [4].
The vulnerability is present in product:
- GitLab; >=18.7.0, <18.9.7; >=18.10.0, <18.10.6; >=18.11.0, <18.11.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-7377 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 5. 2026.
Links
By CESNET, z.s.p.o. Táňa Macháčková on 18. 5. 2026.