Skip to content
OpenAdvisories
High WID-SEC-2026-4115 12 CVEs

GitLab: Mehrere Schwachstellen

Published Oct 21, 2026 · Updated Nov 9, 2026 · Revision 4 · de

Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Rocky Linux Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, erweiterte Berechtigungen zu erlangen, Daten zu manipulieren oder Informationen offenzulegen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 12

  • Critical 10.0
    CVE-2026-110264 Public exploit

    Integer Overflow or Wraparound in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could hav…

    GitLab GitLab ruby ruby3.1 Web / CMS Debian Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2026-15723

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2026-112212

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery documen…

    GitLab GitLab Web / CMS
  • Medium 6.8
    CVE-2026-12664

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a proje…

    GitLab GitLab Web / CMS
  • Medium 5.9
    CVE-2026-16255

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted …

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-105777

    Insertion of Sensitive Information Into Sent Data in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due …

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-112378

    Use of Less Trusted Source in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscripti…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2026-13319

    Authorization Bypass Through User-Controlled Key in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project p…

    GitLab GitLab Web / CMS
  • Low 3.5
    CVE-2026-105711

    Use of Cache Containing Sensitive Information in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated u…

    GitLab GitLab Web / CMS
  • Low 3.1
    CVE-2026-112326

    Improper Cleanup on Thrown Exception in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete ex…

    GitLab GitLab Web / CMS
  • Low 3.1
    CVE-2026-14288

    Use of Incorrectly-Resolved Name or Reference in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a pr…

    GitLab GitLab Web / CMS
  • Low 2.7
    CVE-2026-103515

    Incorrect Authorization in GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions c…

    GitLab GitLab Web / CMS

Revision history

  1. #4

    Neue Updates von Red Hat aufgenommen

  2. #3

    Neue Updates von Red Hat aufgenommen

  3. #2

    Neue Updates von Red Hat aufgenommen

  4. #1

    Initiale Fassung

References