Skip to content
OpenAdvisories
High WID-SEC-2026-2586 13 CVEs

GitLab: Mehrere Schwachstellen

Published Jul 29, 2026 · Updated Jul 29, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 13

  • High 8.5
    CVE-2026-6267

    Insertion of Sensitive Information Into Sent Data in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized infor…

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi
  • High 8.4
    CVE-2026-12436

    Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another…

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi
  • High 7.5
    CVE-2026-15975

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2026-13113

    Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the req…

    GitLab GitLab Web / CMS
  • Medium 5.4
    CVE-2026-16553

    Insufficiently Protected Credentials in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to imp…

    GitLab GitLab Web / CMS
  • Medium 5.3
    CVE-2026-6336

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a …

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi
  • Medium 4.9
    CVE-2026-14341

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch co…

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi
  • Medium 4.7
    CVE-2026-3093

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser vi…

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi
  • Medium 4.3
    CVE-2026-14351

    Exposure of Sensitive Information Through Metadata in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through…

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi
  • Medium 4.3
    CVE-2026-15077

    Improper Neutralization of Input Used for LLM Prompting in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutraliz…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-15831

    Generation of Incorrect Security Tokens in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to imprope…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-4672

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report …

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi
  • Low 3.1
    CVE-2025-14562

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes …

    GitLab GitLab gitlab-runner-18.11 gitlab-runner-helper-18.11 Web / CMS Wolfi

Revision history

  1. #1

    Initiale Fassung

References