Skip to content
OpenAdvisories
High WID-SEC-2026-3029 7 CVEs

GitLab: Mehrere Schwachstellen

Published Aug 25, 2026 · Updated Aug 27, 2026 · Revision 3 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 7

  • High 7.3
    CVE-2026-18252

    Inclusion of Functionality from Untrusted Control Sphere in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-10903

    Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop trigger…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2026-77801

    Allocation of Resources Without Limits or Throttling in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting backgroun…

    GitLab GitLab gitlab-runner-19.2 gitlab-runner-helper-19.2 Web / CMS Wolfi
  • Medium 5.5
    CVE-2026-3035

    Authentication Bypass Using an Alternate Path or Channel in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal o…

    GitLab GitLab Web / CMS
  • Medium 5.4
    CVE-2026-4398

    Authorization Bypass Through User-Controlled Key in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were no…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-15387

    Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution en…

    GitLab GitLab Web / CMS
  • Low 3.5
    CVE-2026-7487

    Access Control Check Implemented After Asset is Accessed in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have…

    GitLab GitLab Web / CMS

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-67167

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-210778, EUVD-2026-66431, EUVD-2026-66430, EUVD-2026-66429, EUVD-2026-66428, EUVD-2026-66427

  3. #1

    Initiale Fassung

References