GitLab Releases Patches for Multiple High-Severity Vulnerabilities
GitLab has issued urgent patch releases addressing critical vulnerabilities, including Cross-Site Scripting and authorization bypass flaws, affecting self-managed installations.
GitLab has released critical patch updates for its Community Edition (CE) and Enterprise Edition (EE), specifically versions 19.2.2, 19.1.4, and 19.0.6. These releases are vital for self-managed GitLab instances and address a range of security vulnerabilities, some of which are rated as high severity. GitLab.com is already running the patched versions, and GitLab Dedicated customers do not require any action.
The vulnerabilities patched span several components, with notable high-severity Cross-Site Scripting (XSS) flaws impacting Analytics Dashboards and CI/CD components. Additionally, several Improper Authorization and Missing Authorization issues have been resolved across various APIs and settings, including the CI/CD pipeline API, Duo Workflow Service, and project settings controllers. These flaws could allow authenticated users to perform actions beyond their intended permissions or expose sensitive information.
One of the high-severity XSS vulnerabilities, CVE-2026-15217, affects the Analytics Dashboards table field configuration. It could allow an attacker to inject malicious scripts due to improper neutralization of user-controlled values. Another XSS flaw, CVE-2026-15216, impacts the pagination controls within Analytics Dashboards, also stemming from improper data neutralization. Both of these vulnerabilities carry a CVSS score of 8.7 and were reported through GitLab's HackerOne bug bounty program.
Authorization issues are also prominent in this patch release. CVE-2026-15423, an Improper Authorization flaw in the CI/CD pipeline API, could permit an authenticated user with developer permissions to execute pipelines on protected branches without proper authorization. Furthermore, CVE-2026-19228, an Authorization Bypass in the Duo Workflow Service, allows an authenticated user to misattribute AI usage to different namespaces. These vulnerabilities highlight the importance of robust access control mechanisms within complex development platforms.
Other significant fixes include a Cross-Site Scripting issue in the CI manual job confirmation modal (CVE-2026-16627), which could lead to privilege escalation for authenticated users. Missing authorization checks in the ProjectsController (CVE-2026-16494) could allow authenticated users to modify restricted project settings. Medium-severity issues include a Denial of Service vulnerability in the GraphQL API JSON parser and missing authorization flaws in various APIs like the merge requests API and external status check API.
GitLab strongly advises all users of self-managed instances to upgrade to the latest patch versions as soon as possible to mitigate these risks. The company follows a security release schedule, with patch releases occurring twice a month, but also issues ad-hoc critical patches for high-severity vulnerabilities. Details of security fixes are typically made public 90 days after their release.
This comprehensive patch release underscores GitLab's commitment to maintaining high security standards for its platform, which hosts sensitive customer data and code. By addressing these vulnerabilities promptly, GitLab aims to protect its users from potential exploitation and maintain the integrity of their development workflows. Users can find detailed information on all security fixes and recommended upgrade paths within the official GitLab release notes.