SB2026022626 - Multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)
Published: February 26, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-0752)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Mermaid sandbox. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Input validation error (CVE-ID: CVE-2025-14511)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in container registry. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-1662)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to allocation of resources without limits or throttling in Jira events endpoint. A remote attacker can pass specially crafted input to the application and cause a denial of service condition on the target system.
4) Incorrect Regular Expression (CVE-ID: CVE-2026-1388)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions in GitLab merge requests. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-2845)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to missing rate limit in Bitbucket Server importer. A remote user can pass specially crafted input to the application and cause a denial of service condition on the target system.
6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-3525)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to allocation of resources without limits or throttling in CI trigger API. A remote user can pass specially crafted input to the application and cause a denial of service condition on the target system.
7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-1725)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to allocation of resources without limits or throttling in token decoder. A remote attacker can pass specially crafted input to the application and cause a denial of service condition on the target system.
8) Improper access control (CVE-ID: CVE-2026-1747)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in Conan package registry. A remote user can make unauthorized modifications to protected Conan packages.
9) Improper access control (CVE-ID: CVE-2025-14103)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in CI job mutation. A remote user can set pipeline variables for manually triggered jobs under certain conditions.
Remediation
Install update from vendor's website.