Skip to content
OpenAdvisories
High WID-SEC-2026-1704 7 CVEs

GitLab: Mehrere Schwachstellen

Published May 27, 2026 · Updated May 27, 2026 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 7

  • High 8.2
    CVE-2026-4868

    Authorization Bypass Through User-Controlled Key in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain conditions, could have allowed an authenticated user to cause specific Duo AI workflows to run under …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2026-1402

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to cause denial of service due to insufficient …

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-6713

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an unauthorized user to enumerate private projects due to incorrect a…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • Medium 4.3
    CVE-2026-2601

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to access sensitiv…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-5296

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that when foundational flows were enabled at the group level, could have allowed an authenticated user with developer-rol…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-8716

    Use of Incorrectly-Resolved Name or Reference in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to access CI data from a different ref type tha…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • Unscored —
    CVE-2026-2710 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Revision history

  1. #1

    Initiale Fassung

References