SB2026081370 - Multiple vulnerabilities in GitLab CE/EE
Published: August 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Improper Authorization (CVE-ID: CVE-2026-8667)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify certain package registry metadata without required maintainer-level permissions.
The vulnerability exists due to improper access control in npm dist-tags endpoint when handling requests to modify package registry metadata. A remote user can send a crafted request to modify certain package registry metadata without required maintainer-level permissions.
The issue affects users with developer role.
2) Cross-site scripting (CVE-ID: CVE-2026-15216)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in a victim's browser.
The vulnerability exists due to cross-site scripting in analytics dashboards pagination controls when rendering user-controlled data in pagination controls. A remote user can inject crafted content to execute arbitrary script in a victim's browser.
User interaction is required.
3) Improper Authorization (CVE-ID: CVE-2026-15423)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute CI/CD pipelines on a protected branch without required push permissions.
The vulnerability exists due to improper access control in CI/CD pipeline API when validating pipeline references. A remote user can submit a pipeline request to execute CI/CD pipelines on a protected branch without required push permissions.
The issue affects users with developer-role permissions.
4) Improper Authorization (CVE-ID: CVE-2026-19228)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to attribute AI usage to another namespace.
The vulnerability exists due to improper access control in Duo Workflow Service when processing identity information supplied in requests. A remote user can supply crafted identity information to attribute AI usage to another namespace.
5) Cross-site scripting (CVE-ID: CVE-2026-16627)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to cross-site scripting in CI manual job confirmation modal when rendering HTML content in a CI job modal. A remote user can inject crafted HTML content to escalate privileges.
User interaction is required.
6) Missing Authorization (CVE-ID: CVE-2026-16494)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify project settings restricted to higher-privileged roles.
The vulnerability exists due to improper access control in ProjectsController when handling project update requests. A remote user can send a crafted project update request to modify project settings restricted to higher-privileged roles.
7) Input validation error (CVE-ID: CVE-2026-7427)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in GraphQL API JSON parser when parsing input. A remote attacker can send a specially crafted request to cause a denial of service.
8) Missing Authorization (CVE-ID: CVE-2026-6821)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose limited merge request information from a private project.
The vulnerability exists due to improper access control in merge requests API when handling requests to a merge requests endpoint. A remote user can send a crafted request to disclose limited merge request information from a private project.
The issue can bypass IP-based access restrictions.
9) Missing Authorization (CVE-ID: CVE-2026-4879)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose external status check configuration restricted to higher-privileged roles.
The vulnerability exists due to improper access control in external status check API when handling requests to a merge request API endpoint. A remote user can send a crafted request to disclose external status check configuration restricted to higher-privileged roles.
The issue affects users with developer-role permissions.
10) Cross-site scripting (CVE-ID: CVE-2026-15217)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in a victim's browser.
The vulnerability exists due to cross-site scripting in analytics dashboards table field configuration when rendering user-controlled values in table cell content. A remote user can inject crafted content to execute arbitrary script in a victim's browser.
User interaction is required.
11) Improper Authorization (CVE-ID: CVE-2026-18244)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose restricted configuration settings.
The vulnerability exists due to improper access control in GitLab Duo settings page when accessing a group settings page. A remote user can access the page to disclose restricted configuration settings.
12) Improper Authorization (CVE-ID: CVE-2026-18433)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose policy configuration belonging to an unauthorized namespace.
The vulnerability exists due to improper access control in AI Tool Rules GraphQL resolver when processing a GraphQL query. A remote user can send a crafted GraphQL query to disclose policy configuration belonging to an unauthorized namespace.
13) Incorrect Privilege Assignment (CVE-ID: CVE-2025-9486)
CWE-ID: CWE-266 - Incorrect Privilege Assignment
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to assign custom role permissions to a user with a pending membership.
The vulnerability exists due to incorrect privilege assignment in custom roles when applying permissions without accounting for membership state. A remote privileged user can assign a custom role to assign custom role permissions to a user with a pending membership.
Remediation
Install update from vendor's website.