Skip to content
OpenAdvisories
High WID-SEC-2026-1886 12 CVEs

GitLab: Mehrere Schwachstellen

Published Jun 10, 2026 · Updated Jun 11, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, serverseitige Request-Forgery- und Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 12

  • High 8.7
    CVE-2026-10087

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitra…

    GitLab GitLab Web / CMS
  • High 8.7
    CVE-2026-6552 Rejected

    This CVE ID has been rejected. GitLab determined that the reported behavior does not constitute a vulnerability: linkin…

    gitlab gitlab-runner-18.8 gitlab-runner-helper-18.8 gitlab-runner-helper-18.7 Ubuntu Wolfi
  • High 7.5
    CVE-2026-7250

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper i…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • High 7.3
    CVE-2026-8589

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targete…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • Medium 6.5
    CVE-2026-1500

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to cause denial of service due to uncontrolled…

    GitLab GitLab Web / CMS
  • Medium 5.4
    CVE-2026-6269

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to modify hidd…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2026-9204

    Server-Side Request Forgery (SSRF) in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server…

    GitLab GitLab gitlab gitlab-runner-18.11 Web / CMS Ubuntu Wolfi
  • Medium 4.3
    CVE-2026-10733

    Improper Restriction of Rendered UI Layers or Frames in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper san…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-6277

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage p…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • Low 3.7
    CVE-2026-6976

    Authorization Bypass Through User-Controlled Key in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to hide changes…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi
  • Low 3.1
    CVE-2026-3553

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to access confidential issue details due to inc…

    GitLab GitLab Web / CMS
  • Low 2.6
    CVE-2026-9694

    Improper Neutralization of Substitution Characters in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and in…

    GitLab GitLab gitlab gitlab-runner-18.8 Web / CMS Ubuntu Wolfi

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-36229, EUVD-2026-36228, EUVD-2026-36227, EUVD-2026-36226, EUVD-2026-36225, EUVD-2026-36224, EUVD-2026-36223, EUVD-2026-36222, EUVD-2026-36230, EUVD-2026-36231, EUVD-2026-36233, EUVD-2026-36232

  2. #1

    Initiale Fassung

References