Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 18.6 – < 18.6.3, 18.7 – < 18.7.1 | 18.6.3 |
Advisories 2
- WID-SEC-2026-0037 GitLab CE und EE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2026
- NCSC-2026-0003 Kwetsbaarheden verholpen in GitLab NCSC-NL (Netherlands) · Jan 9, 2026
References
- GitLab Issue #582237 issue-tracking permissions-required
- HackerOne Bug Bounty Report #3441368 technical-description exploit permissions-required
- https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/