GitLab Patches 8 Vulnerabilities Affecting CE and EE Installations

GitLab has released critical security updates to address eight vulnerabilities in its Community Edition (CE) and Enterprise Edition (EE). Administrators are urged to upgrade immediately to versions 19.1.2, 19.0.4, or 18.11.7.

The patch rollout on July 8, 2026, includes fixes for high-, medium-, and low-severity flaws affecting core functionalities such as wiki rendering, repository mirroring, access controls, and compliance management. While GitLab.com is already running the patched versions, self-managed deployments remain at risk if they are not updated.

GitLab Patches 8 Vulnerabilities

Among the most severe issues is CVE-2026-6896 (CVSS 8.7), a cross-site scripting (XSS) vulnerability affecting the vulnerability evidence table renderer in GitLab EE. This flaw allows an authenticated user with developer-level access to inject malicious scripts into another user’s browser session due to improper input sanitization.

Another significant issue, CVE-2026-13320 (CVSS 7.3), introduces an HTML injection vulnerability in wiki markup rendering that affects both CE and EE, allowing attackers with high privileges to execute arbitrary scripts through crafted content.

GitLab has also patched several medium-severity vulnerabilities that could expose sensitive data or bypass access restrictions. CVE-2026-11827 (CVSS 4.9) affects repository mirroring in GitLab EE, where insufficient credential protection could allow a maintainer-level user to retrieve other users’ stored credentials.

CVE-2026-8472 (CVSS 4.3) involves improper access control in work items, which could allow low-privileged users to access metadata from private projects. Additionally, CVE-2026-7492 (CVSS 4.3) affects both CE and EE, enabling unauthorized users to infer the presence of private projects via commit discussion displays due to missing authorization checks.

Furthermore, GitLab has addressed three low-severity vulnerabilities that still pose security risks in specific scenarios. CVE-2025-12506 (CVSS 3.5) presents an ambiguity in branch or tag handling that could lead to discrepancies between displayed and downloaded repository content, potentially misleading users.

CVE-2026-13151 (CVSS 2.7) affects group-level settings in GitLab EE, allowing authenticated users to modify configurations beyond their intended permissions. CVE-2026-6352 (CVSS 2.7) affects compliance violation management, where improper authorization in GraphQL operations could allow auditor-level users to modify compliance records.

All vulnerabilities were responsibly disclosed through GitLab’s HackerOne bug bounty program, except for CVE-2026-13151, which was identified internally.

The wide range of impact, spanning versions as early as GitLab 9.1 in some cases, highlights the importance of timely patching, especially for long-lived self-managed environments.

In addition to security fixes, the patch releases include bug fixes and improvements, such as updates to Go 1.25.11, enhancements to OAuth application handling, stability fixes for CI/CD pipelines, and performance improvements that address memory leaks and registry issues.

However, GitLab warns that the update involves database migrations that may cause downtime for single-node deployments. At the same time, multi-node environments can achieve near-zero-downtime upgrades by following best practices.

GitLab continues its twice-monthly scheduled patch cycle but emphasizes that critical security updates like these need immediate attention.

Organizations running affected versions are strongly advised to upgrade without delay to mitigate exploitation risks, particularly for vulnerabilities related to XSS, credential exposure, and access control weaknesses that could be exploited in real-world attacks.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN