Skip to content
OpenAdvisories
High WID-SEC-2026-2805 13 CVEs

GitLab: Mehrere Schwachstellen

Published Aug 12, 2026 · Updated Aug 12, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 13

  • High 8.7
    CVE-2026-15216

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled d…

    GitLab GitLab Web / CMS
  • High 8.7
    CVE-2026-15217

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled v…

    GitLab GitLab Web / CMS
  • High 8.5
    CVE-2026-15423

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD p…

    GitLab GitLab Web / CMS
  • High 8.5
    CVE-2026-19228

    Authorization Bypass Through User-Controlled Key in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper a…

    GitLab GitLab Web / CMS
  • High 7.7
    CVE-2026-16627

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML co…

    GitLab GitLab Web / CMS
  • High 7.1
    CVE-2026-16494

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to m…

    GitLab GitLab Web / CMS
  • Medium 5.3
    CVE-2026-7427

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper inp…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-18244

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to impr…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-18433

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not author…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-4879

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external stat…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-6821

    Missing Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limit…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-8667

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package regi…

    GitLab GitLab Web / CMS
  • Low 3.3
    CVE-2025-9486

    Incorrect Privilege Assignment in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom…

    GitLab GitLab Web / CMS

Revision history

  1. #1

    Initiale Fassung

References