Vulnerabilities · 91 days ago
GitLab’s risk here is not a front-end bug. These flaws reach the controls that decide who can review, approve, merge, and see project data, so low-privilege or unauthenticated users could bend trusted collaboration paths instead of just breaking a page.
GitLab fixed multiple issues in versions before 19.0.5, 19.1.3, and 19.2.1 for GitLab and GitLab Enterprise Edition. The set includes access-control failures, CI/CD pipeline tampering, approval bypass, credential exposure, XSS, and an AI-assisted code review flaw that could be steered into revealing project information.
The practical point is that patching closes the code, not the damage already done to trust decisions. If a self-managed instance is exposed, the blast radius can include unauthorized changes, weakened branch protection, and leakage from collaboration features developers treat as safe.
CVEs in this update
10 CVEs
Across GitLab.
0 critical · 3 high · 6 medium · 1 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-6267 · 8.5 HIGH
2 sources covering this story
Risolte vulnerabilità su GitLab CE/EE
Rilasciati aggiornamenti di sicurezza che risolvono 13 vulnerabilità, di cui 3 con gravità "alta", in GitLab Community Edition (CE) ed Enterprise Edition (EE).
Kwetsbaarheden verholpen in GitLab door GitLab Inc.
heeft meerdere kwetsbaarheden verholpen in GitLab, specifiek in versies voorafgaand aan 19.0.5, 19.1.3 en 19.2.1, inclusief GitLab Enterprise Edition (EE) versies binnen deze reeksen.
Part of the PlainSec briefing for 2026-07-31