SB20261022490 - Multiple vulnerabilities in GitLab CE/EE
Published: October 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Use of cache containing sensitive information (CVE-ID: CVE-2026-105711)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read a confidential issue's title without membership in the private project containing the issue.
The vulnerability exists due to use of a cache containing sensitive information in merge request title rendering when a public project's merge request references a confidential issue in a private project. A remote user can view the affected merge request after rendered content has been cached to read the confidential issue's title because a viewer-independent fragment cache key shares per-user-redacted content across users.
2) Improper Authentication (CVE-ID: CVE-2026-15723)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to take over an existing LDAP-backed account.
The vulnerability exists due to improper authentication caused by insufficient input sanitization in the LDAP email lookup path when linking OmniAuth identities. A remote user can manipulate input used during identity linking to take over an existing LDAP-backed account.
Exploitation requires both OmniAuth SAML and LDAP auto-linking to be enabled.
3) Acceptance of Extraneous Untrusted Data With Trusted Data (CVE-ID: CVE-2026-112212)
CWE-ID: CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison cached OAuth/OIDC discovery documents and redirect certain flows to an externally controlled server.
The vulnerability exists due to improper trust of user-supplied values in OAuth/OIDC discovery endpoints when constructing endpoint URLs in cached discovery responses. A remote attacker can supply crafted values to poison a shared discovery document and redirect affected flows to an externally controlled server when users consume the poisoned document.
4) Improper access control (CVE-ID: CVE-2026-12664)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to retrieve a project's incoming email address and create work items despite read-only token restrictions.
The vulnerability exists due to insufficient scope enforcement in the GraphQL work item email address field when processing queries authorized with a read_api-scoped token. A remote user can query the field using such a token to obtain the project's incoming email address and use it to create work items outside the token's permitted scope.
5) Improper access control (CVE-ID: CVE-2026-16255)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to grant or accept project and group membership outside the identity provider's control.
The vulnerability exists due to incomplete enforcement of the instance-wide SAML/LDAP membership lock when handling membership requests created before the lock was enabled. A remote user can grant or accept these earlier requests after the lock is enabled to establish project or group membership outside the identity provider's control.
6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-105777)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to retrieve sensitive internal server credentials.
The vulnerability exists due to improper filtering of sensitive information in internal response headers when handling requests. A remote user can obtain exposed internal response header values to retrieve sensitive internal server credentials.
7) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-13319)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read milestone metadata from arbitrary private projects across the GitLab instance without project membership.
The vulnerability exists due to authorization bypass through a user-controlled key in the group milestones API when processing a user-supplied project filter parameter without authorization checks. A remote user can manipulate this filter to retrieve milestone titles, descriptions, and full project paths from private projects without membership.
8) Use of Less Trusted Source (CVE-ID: CVE-2026-112378)
CWE-ID: CWE-348 - Use of Less Trusted Source
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access paid AI features without a valid subscription.
The vulnerability exists due to use of a less trusted source and insufficient server-side validation in AI Gateway billing eligibility checks when determining feature enablement from a header. A remote user can influence the feature enablement header to access paid AI features without a valid subscription.
9) Integer overflow (CVE-ID: CVE-2026-110264)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the GitLab server.
The vulnerability exists due to integer overflow in the regular expression compiler when compiling specially crafted regular expressions. A remote attacker can supply a specially crafted regular expression to execute arbitrary code on the server.
10) Improper access control (CVE-ID: CVE-2026-14288)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass a required merge request approval policy on a protected branch.
The vulnerability exists due to improper access control in merge request approval policy enforcement when synchronizing approval rules. A remote user can exploit insufficient access checks during synchronization to bypass a required approval policy on a protected branch.
11) Improper Cleanup on Thrown Exception (CVE-ID: CVE-2026-112326)
CWE-ID: CWE-460 - Improper Cleanup on Thrown Exception
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to permanently delete existing vulnerability records despite having only read-only permissions.
The vulnerability exists due to improper cleanup on a thrown exception in security findings processing when error handling fails to distinguish pre-existing vulnerability records from newly created records. A remote user can trigger the affected error-handling path with read-only permissions to cause cleanup logic to permanently delete existing vulnerability records.
12) Improper access control (CVE-ID: CVE-2026-103515)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to override an administrator's Duo availability lock and re-enable AI-backed data egress to a third-party service for a group and its descendant projects.
The vulnerability exists due to improper access control in group Duo admin-lock enforcement for Amazon Q settings when an instance administrator has locked the group's Duo availability. A remote privileged user can change the affected settings with group Owner permissions to re-enable AI-backed data egress for the group and its descendant projects because the enforcement controls lack sufficient granularity.
Remediation
Install update from vendor's website.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-105711---use-of-cache-containing-sensitive-information-issue-in-merge-request-title-rendering-impacts-gitlab-ceee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-15723---improper-authentication-issue-in-omniauth-to-ldap-auto-linking-email-lookup-impacts-gitlab-ceee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-112212---cache-poisoning-issue-in-oauthoidc-discovery-endpoints-impacts-gitlab-ceee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-12664---improper-access-control-issue-in-graphql-work-item-email-address-field-impacts-gitlab-ceee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-16255---incomplete-enforcement-of-instance-wide-samlldap-membership-lock-allows-unauthorized-member-additions-in-gitlab-ee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-105777---internal-credential-exposure-issue-in-internal-response-headers-impacts-gitlab-ceee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-13319---authorization-bypass-through-user-controlled-key-issue-in-group-milestones-api-impacts-gitlab-ceee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-112378---use-of-less-trusted-source-issue-in-ai-gateway-feature-enablement-header-impacts-gitlab-ee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-14288---improper-access-control-issue-in-merge-request-approval-policy-enforcement-impacts-gitlab-ee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-112326---improper-cleanup-on-thrown-exception-issue-in-security-findings-impacts-gitlab-ee
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-103515---improper-access-control-issue-in-group-duo-admin-lock-enforcement-for-amazon-q-settings-impacts-gitlab-ee