Skip to content
OpenAdvisories
High WID-SEC-2026-0037 7 CVEs

GitLab CE und EE: Mehrere Schwachstellen

Published Jan 7, 2026 · Updated Jan 11, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 7

  • High 8.7
    CVE-2025-9222

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Mark…

    GitLab GitLab Web / CMS
  • High 8.0
    CVE-2025-13761

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the…

    GitLab GitLab Web / CMS
  • High 7.1
    CVE-2025-13772

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipu…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-10569

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to create a denial of service condition by providing crafted responses to ex…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-13781

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing aut…

    GitLab GitLab Web / CMS
  • Medium 5.4
    CVE-2025-11246

    Insufficient Granularity of Access Control in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated proj…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.5
    CVE-2025-3950

    Exposure of Private Personal Information to an Unauthorized Actor in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak certain information by referencing specially crafted images that bypass asset prox…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-1767, EUVD-2026-1768, EUVD-2026-1771, EUVD-2026-1773, EUVD-2026-1763, EUVD-2026-1770, EUVD-2026-1757

  2. #1

    Initiale Fassung

References