Skip to content
OpenAdvisories
High WID-SEC-2026-0847 12 CVEs

GitLab: Mehrere Schwachstellen

Published Mar 24, 2026 · Updated Mar 25, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 12

  • High 8.1
    CVE-2026-2370

    Improper Handling of Parameters in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions t…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 8.1
    CVE-2026-3857

    Cross-Site Request Forgery (CSRF) in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated user…

    GitLab GitLab Web / CMS
  • High 7.7
    CVE-2026-2995

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitizatio…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2026-3988

    Inefficient Algorithmic Complexity in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive…

    GitLab GitLab Web / CMS
  • Medium 6.8
    CVE-2026-1724

    Missing Authentication for Critical Function in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access contr…

    GitLab GitLab Web / CMS
  • Medium 6.8
    CVE-2026-2745

    Authentication Bypass Using an Alternate Path or Channel in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized acce…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-13078

    Improper Validation of Specified Quantity in Input in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2025-13436

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when h…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.4
    CVE-2026-2973

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanit…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2025-14595

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadat…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-2726

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2026-4363

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to imp…

    GitLab GitLab Web / CMS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-15481, EUVD-2026-15804, EUVD-2026-15803, EUVD-2026-15809, EUVD-2026-15811, EUVD-2026-15935, EUVD-2026-15937, EUVD-2025-208993, EUVD-2025-208991, EUVD-2025-208995, EUVD-2026-15484

  2. #1

    Initiale Fassung

References