This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 12 vulnerabilities
GitLab versions 19.0.2, 18.11.5 and 18.10.8 fix 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The most severe ones are listed below, the rest can be found at [1].
An authenticated remote attacker with the group owner role can take over the account of another group member in GitLab EE due to improper authorization in the Group SAML identity management functionality [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=15.5, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2026-6552 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An authenticated remote attacker with Developer role permissions can exploit an XSS vulnerability and execute arbitrary code on behalf of the target user in GitLab EE due to improper input sanitization in the Analytics Dashboard [1].
The vulnerability is present in product:
- GitLab EE; >=17.1, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-10087 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation („Cross-site Scripting“) at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An unauthenticated remote attacker can perform a DoS attack in GitLab CE/EE due to improper input validation in the API request parsing middleware [1].
The vulnerability is present in products:
- GitLab Community Edition; >=12.10, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
- GitLab Enterprise Edition; >=12.10, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-7250 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An authenticated remote attacker can exploit an HTML injection vulnerability and add unauthorized e-mail addresses to the target user's account in GitLab EE due to improper sanitization of user input in certain group settings fields [1].
The vulnerability is present in product:
- GitLab Enterprise Edition; >=13.1.4, <=18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2026-8589 at cve.org, NVD
- CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An authenticated remote attacker can perform a DoS attack in GitLab CE/EE due to uncontrolled resource consumption when processing a specially crafted file [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.10, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
- GitLab Enterprise Edition; >=17.10, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-1500 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An authenticated remote attacker with Developer role permissions can modify hidden merge requests in GitLab CE/EE due to improper authorization enforcement in the Merge Requests API [1].
The vulnerability is present in products:
- GitLab Community Edition; >=15.10, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
- GitLab Enterprise Edition; >=15.10, <18.10.8; >=18.11, <18.11.5; >=19.0, <19.0.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
More information:
- CVE-2026-6269 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
By CESNET, z.s.p.o. Michaela Jarošová on 11. 6. 2026.