SB2026091149 - Multiple vulnerabilities in GitLab CE/EE
Published: September 11, 2026 Updated: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 vulnerabilities.
1) Improper Authentication (CVE-ID: CVE-2026-12910)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass SAML SSO sign-in restrictions and authenticate without SSO.
The vulnerability exists due to missing authentication enforcement checks in SAML SSO sign-in restriction enforcement when processing sign-in requests. A remote user can bypass SAML SSO sign-in restrictions to authenticate without SSO.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-87719)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in GraphQL subscription serializer. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Buffer overflow (CVE-ID: CVE-2026-88765)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Unicode conversion wrapper. A remote user can import a specially crafted Git project export, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Missing Authorization (CVE-ID: CVE-2026-79708)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to insufficient scope validation. A remote user can execute a policy test pipeline on projects within their group and access protected CI/CD variables.
5) Cross-site scripting (CVE-ID: CVE-2026-78252)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Markdown JSON table renderer. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Incorrect authorization (CVE-ID: CVE-2026-13210)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to incorrect authorization in CI/CD environment variable scope matcher. A remote user can access CI/CD variables outside their intended environment scope.
7) Resource exhaustion (CVE-ID: CVE-2025-14871)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper resource allocation limits in the GraphQL complexity calculation logic. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-1168)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper resource allocation limits in the GraphQL complexity calculation logic. A remote attacker can perform a denial of service (DoS) attack.
9) Race condition (CVE-ID: CVE-2024-11222)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform actions in the context of another user\'s merge request commit.
The vulnerability exists due to a race condition in merge request pipeline creation when creating pipelines. A remote user can exploit the race condition to perform actions in the context of another user\'s merge request commit.
User interaction is required.
10) Cross-site scripting (CVE-ID: CVE-2026-19619)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the context of a targeted user\'s session.
The vulnerability exists due to improper sanitization of pasted HTML content in the Content Editor when rendering pasted HTML content. A remote attacker can provide crafted HTML content to execute arbitrary JavaScript in the context of a targeted user\'s session.
User interaction is required.
11) Path traversal (CVE-ID: CVE-2026-85706) Exploited
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in repository commits API. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
12) Improper access control (CVE-ID: CVE-2026-86341)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform unapproved deployments to production.
The vulnerability exists due to improper access control checks in protected environment approval rules when modifying protected resources. A remote privileged user can disable protected environment deployment approval requirements to perform unapproved deployments to production.
13) Incorrect authorization (CVE-ID: CVE-2026-86340)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass required deployment approvals for protected environments.
The vulnerability exists due to an authorization bypass in protected environment approval rules when deleting the sole approver group or user account. A remote privileged user can delete the sole approver group or user account to bypass required deployment approvals for protected environments.
14) Missing Authorization (CVE-ID: CVE-2026-7514)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to substitute package file content and hide packages from their owners.
The vulnerability exists due to missing authorization in the Generic Package Registry when managing packages. A remote user can modify package content and package visibility to substitute package file content and hide packages from their owners.
Exploitation requires developer-role permissions.
15) Input validation error (CVE-ID: CVE-2026-8030)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to prevent another user from modifying group settings.
The vulnerability exists due to improper input validation in namespace transfer when validating group URL slugs. A remote user can use an improperly validated group URL slug during a namespace transfer to prevent another user from modifying group settings.
16) Missing Authorization (CVE-ID: CVE-2026-16794)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary CI/CD jobs and access protected variables within group projects.
The vulnerability exists due to improper authorization controls in compliance framework management when managing compliance frameworks. A remote user can manage compliance frameworks to execute arbitrary CI/CD jobs and access protected variables within group projects.
Exploitation requires the Security Manager role.
17) Input validation error (CVE-ID: CVE-2026-3855)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access restricted file contents on the server.
The vulnerability exists due to improper input validation in the Terraform state API when processing parameters in Terraform state uploads. A remote user can submit improperly validated parameters in a Terraform state upload to access restricted file contents on the server.
Exploitation requires project-level permissions.
18) Incorrect authorization (CVE-ID: CVE-2026-82837)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to access sensitive credentials and tokens.
The vulnerability exists due to improper authorization checks in Workhorse senddata emitters when accessing internal data emission endpoints. A remote attacker can access internal data emission endpoints to obtain sensitive credentials and tokens.
The credentials and tokens can be obtained without transiting the expected proxy.
Remediation
Install update from vendor's website.