This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 7 vulnerabilities
GitLab fixes 7 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 19.0.1, 18.11.4 and 18.10.7. The most severe of them can be found below, the remaining ones at [1].
An authenticated remote attacker can, under certain conditions, run selected Duo AI workflows under the identity of another user in GitLab EE [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=18.8, <18.10.7; >=18.11, <18.11.4; >=19.0, <19.0.1
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2026-4868 at cve.org, NVD
- CWE-639: Authorization Bypass Through User-Controlled Key at cwe.mitre.org
The vulnerability was publicly disclosed 27. 5. 2026.
An authenticated remote attacker can, under certain conditions, carry out a DoS attack in GitLab CE/EE due to insufficient validation in the Wiki [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.1, <18.10.7; >=18.11, <18.11.4; >=19.0, <19.0.1
- GitLab Enterprise Edition; >=17.1, <18.10.7; >=18.11, <18.11.4; >=19.0, <19.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-1402 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 27. 5. 2026.
An unauthenticated remote attacker can, under certain conditions, enumerate private projects in GitLab CE/EE due to improper authorization checks in the GraphQL WorkItem API [1].
The vulnerability is present in product:
- GitLab Community Edition; >=18.2, <18.10.7; >=18.11, <18.11.4; >=19.0, <19.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2026-6713 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 27. 5. 2026.
By CESNET, z.s.p.o. Michaela Jarošová on 29. 5. 2026.