GitLab: Nine Vulnerabilities Including XSS and Auth Bypass Patched in Coordinated August 12 Release
GitLab Inc. patched nine vulnerabilities disclosed on August 12, 2026, including high-severity XSS and authorization flaws across its CE/EE products.
Key findings
- GitLab released updates for 9 vulnerabilities on August 12, 2026, affecting CE/EE versions.
- High-severity flaws include XSS in analytics dashboards and privilege escalation via CI job modals.
- Authorization weaknesses allowed unauthorized access to policy configurations and project settings.
- Affected versions range from 12.0, 15.6, 17.7, 18.2, 19.0, 19.1, and 19.2 before specific patch releases.
- Patched versions are 19.0.6, 19.1.4, and 19.2.2; self-managed instances should upgrade immediately.
On August 12, 2026, GitLab Inc. released security updates across multiple versions of its Community Edition (CE) and Enterprise Edition (EE) to address a batch of nine vulnerabilities disclosed on the same day. The vulnerabilities, spanning from low to high severity, impact various components including analytics dashboards, CI/CD pipelines, and authorization mechanisms. The timely disclosure and patching of these flaws are crucial for maintaining the security posture of self-managed GitLab instances.
Several of the disclosed vulnerabilities stem from authorization and access control weaknesses. CVE-2026-18433, a medium-severity flaw, allowed an authenticated user to read unauthorized namespace policy configurations due to incorrect authorization checks. Similarly, CVE-2026-16494, a high-severity issue, permitted authenticated users to modify restricted project settings because of missing authorization checks on a project update endpoint. Another medium-severity vulnerability, CVE-2026-18244, enabled authenticated users to view restricted group settings due to improper authorization checks. CVE-2026-6821, also medium-severity, could allow authenticated users to bypass IP-based access restrictions and access limited merge request information from private projects. Finally, CVE-2026-15423, a high-severity flaw, allowed authenticated users with developer roles to execute CI/CD pipelines on protected branches without proper permissions.
Cross-site scripting (XSS) vulnerabilities were also prominent in this batch. CVE-2026-15217 and CVE-2026-15216, both high-severity (CVSSv3 8.7), were caused by improper neutralization of user-controlled values rendered in analytics dashboard components, specifically within table cell content and pagination controls, respectively. A further high-severity vulnerability, CVE-2026-16627 (CVSSv3 7.7), allowed authenticated users with developer roles to escalate privileges due to improper sanitization of HTML content in a CI job modal.
A low-severity issue, CVE-2025-9486, was also addressed, where a user with a pending membership could incorrectly receive permissions granted by a custom role due to flawed privilege assignment.
GitLab addressed these vulnerabilities by releasing updated versions: 19.0.6, 19.1.4, and 19.2.2. The affected versions range from 12.0 before 19.0.6, 15.6 before 19.0.6, 17.7 before 19.0.6, 18.2 before 19.0.6, 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2, depending on the specific CVE. GitLab strongly advises all self-managed customers to upgrade to one of these patched versions immediately. GitLab.com has already been updated, and GitLab Dedicated customers require no action.
The coordinated disclosure of these nine vulnerabilities highlights the ongoing efforts by GitLab to secure its platform. Users are urged to apply the necessary updates promptly to mitigate the risks associated with these security flaws, particularly the high-severity XSS and authorization bypass issues. Staying current with GitLab's security releases is essential for protecting sensitive project data and maintaining the integrity of CI/CD workflows.