GitLab Security Bulletin: Multiple Critical Fixes (SSRF/XSS/IDOR) in EE/CE

GitLab Vulnerability Summary Vulnerability Overview GitLab released multiple security patches addressing several critical security vulnerabilities. These include Cross-Site Scripting (XSS), information disclosure, authorization bypasses, and improper access controls. Affected Versions GitLab EE: All versions from 16.4 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab CE/EE: All versions from 18.10 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab EE: All versions from 18.6 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab CE/EE: All versions from 17.5 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab EE: All versions from 13.11 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab CE/EE: All versions from 9.3 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab CE/EE: All versions from 14.8 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab CE/EE: All versions from 17.11 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab CE/EE: All versions from 13.6 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab EE: All versions from 17.9 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab EE: All versions from 18.6 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 GitLab CE/EE: All versions from 8.3 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1 Remediation Upgrade to the latest version: It is strongly recommended that all affected GitLab installations be upgraded to the latest versions (19.1.1, 19.0.3, or 18.11.6). Specific remediation measures: - CVE-2026-10086: Fixed a Cross-Site Scripting (XSS) issue in the Analytics Dashboard. - CVE-2026-10712: Fixed a Cross-Site Scripting (XSS) issue in the Web IDE workbench asset handler. - CVE-2026-12053: Fixed an information disclosure issue in Duo Workflows. - CVE-2026-5309: Fixed an authorization bypass in the Virtual Registry Cleanup Policy API. - CVE-2026-2238: Fixed an improper authorization issue in Rapid Diffs. - CVE-2026-11379: Fixed an improper authorization issue in the DAST scanner and site profile management. - CVE-2026-8330: Fixed an insufficient filtering issue in the CI/CD API. - CVE-2026-1606: Fixed an improper input validation issue in Snippets. - CVE-2026-5952: Fixed an improper authorization issue in the Maven Package Registry. - CVE-2026-5796: Fixed an improper access control issue in the group packages API. - CVE-2026-0934: Fixed an improper access control issue in the Protected Environments API. - CVE-2026-3176: Fixed a missing authorization issue in the Security Dashboard. - CVE-2026-12635: Fixed a Server-Side Request Forgery (SSRF) issue in Repository Mirroring. Proof of Concept (POC) or Exploit Code No specific POC code or exploit code was provided on the page. Conclusion GitLab has released multiple security patches addressing several critical vulnerabilities. All affected GitLab installations are advised to upgrade to the latest versions (19.1.1, 19.0.3, or 18.11.6) to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

GitLab Security Bulletin: Multiple Critical Fixes (SSRF/XSS/IDOR) in EE/CE