GitLab has released security updates for GitLab CE/EE and EE that patch multiple vulnerabilities, including several high‑impact flaws that could lead to account takeover, data exposure, and denial of service if left unpatched.
Administrators are strongly advised to upgrade to GitLab 19.0.2, 18.11.5, or 18.10.8, as applicable, to fully mitigate these issues.
GitLab has shipped a coordinated set of security patches addressing a dozen vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE), spanning features such as Group SAML identity management, Analytics Dashboards, various APIs, CI/CD Catalog, and Gitaly‑based repository imports.
The release notes highlight that these flaws affect a wide range of versions, with fixes delivered in GitLab 19.0.2, 18.11.5, and 18.10.8, which are now the minimum recommended releases for self‑managed instances.
Two of the most severe issues, both rated CVSS 8.7, can directly facilitate account takeover or code execution in a victim’s browser if exploited in the right conditions.
Additional issues include denial‑of‑service vectors, multiple improper access control bugs, server‑side request forgery (SSRF), and HTML injection paths that can be chained to broaden their impact in complex GitLab deployments.
The first critical path to account compromise is an improper access control flaw in the Group SAML Identity API, tracked as CVE‑2026‑6552 and affecting GitLab EE.
Under specific conditions, an authenticated user with a Group Owner role could take over another member’s GitLab account by abusing authorization weaknesses in the Group SAML identity management workflow.
This issue impacts GitLab EE versions from 15.5 up to, but not including, 18.10.8, 18.11.5, and 19.0.2, and is rated 8.7 under CVSS 3.1.
A second high‑severity vulnerability, CVE‑2026‑10087, is a cross‑site scripting (XSS) bug in the Analytics Dashboard impacting GitLab EE.
Here, an authenticated user with Developer‑level permissions can inject malicious client‑side code that executes in the context of a targeted user, due to insufficient input sanitization in Analytics Dashboard components.
The bug affects GitLab EE versions from 17.1 up to the same fixed patch levels. It is also rated CVSS 8.7, reflecting the potential for session hijacking, privilege escalation, and account takeover scenarios within GitLab.
The patched releases, GitLab 19.0.2, 18.11.5, and 18.10.8, bundle both these security fixes and numerous stability improvements and backports, including updates to Ruby JWT dependencies, Rails components, Gitaly, and the Container Registry.
GitLab notes that single‑node deployments should expect downtime during the upgrade due to required database migrations. At the same time, multi‑node environments can follow zero‑downtime upgrade procedures to minimize disruption.
Administrators are urged to plan upgrades promptly, review audit logs for suspicious account or API activity in affected components, and consider rotating sensitive credentials if exploitation is suspected.
Patched Vulnerabilities
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…