GitLab CE/EE fixes 13 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitLab CE/EE fixes 13 vulnerabilities

GitLab fixes 13 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.1.1, 19.0.3 and 18.11.6. The most severe of them are described below; the rest can be found at [1].

GitLab EE - XSS (CVE-2026-10086)

CVSS 8.7 (High)

Allows an authenticated remote attacker with Developer role permissions, under certain conditions and due to insufficient sanitization of user input, to execute arbitrary client-side code in the context of another user's session [1].

The vulnerability is present in product:

GitLab EE; >=16.4, <18.11.6; >=19.0, <19.0.3; >=19.1, <19.1.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

More information:

CVE-2026-10086 at cve.org, NVD
CWE-264: Permissions, Privileges, and Access Controls at cwe.mitre.org

The vulnerability was publicly disclosed 24. 6. 2026.

GitLab CE/EE - XSS (CVE-2026-10712)

CVSS 8.0 (High)

Allows an unauthenticated remote attacker, under certain conditions and due to improper path validation, to execute arbitrary JavaScript in the user's browser [1].

The vulnerability is present in product:

GitLab CE/EE; >=18.10, <18.11.6; >=19.0, <19.0.3; >=19.1, <19.1.1

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

More information:

CVE-2026-10712 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 6. 2026.

GitLab EE - information disclosure (CVE-2026-12053)

CVSS 7.7 (High)

Allows an authenticated remote attacker with low privileges, under certain conditions and due to insufficient output filtering in Duo Workflows, to gain access to sensitive information that has already been stored in the repository [1].

The vulnerability is present in product:

GitLab EE; >=19.1, <19.1.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

More information:

CVE-2026-12053 at cve.org, NVD
CWE-532: Insertion of Sensitive Information into Log File at cwe.mitre.org

The vulnerability was publicly disclosed 24. 6. 2026.

Report feedback

[TLP:CLEAR] GitLab CE/EE fixes 13 vulnerabilities

GitLab EE - XSS (CVE-2026-10086)

CVSS 8.7 (High)

GitLab CE/EE - XSS (CVE-2026-10712)

CVSS 8.0 (High)

GitLab EE - information disclosure (CVE-2026-12053)

CVSS 7.7 (High)

Links