Multiple vulnerabilities affecting GitLab Community Edition (CE) and Enterprise Edition (EE)
Multiple vulnerabilities have been discovered in GitLab CE and EE, allowing a malicious actor to bypass protections, cause denials of service, or compromise security mechanisms, leading to the risk of service interruption and unauthorized account access.
Description
Technical context and vulnerability details
GitLab Community Edition (CE) and Enterprise Edition (EE) are platforms for managing source code repositories, continuous integration and deployment (CI/CD), as well as collaboration between development teams. These solutions are affected by several vulnerabilities labeled as follows: CVE-2025-13927: This vulnerability arises from improper validation of authentication data in the Jira Connect integration. An unauthenticated threat actor could send specially crafted requests with malformed authentication data, causing a denial of service (DoS) condition on the affected GitLab instance. This vulnerability is classified as high with a severity score of 7.5 according to CVSS v3.1. CVE-2025-13928: This vulnerability is due to improper management of permissions in the API. It would allow an unauthenticated malicious actor to send unauthorized requests, causing a denial of service. This vulnerability is classified as high with a severity score of 7.5 according to CVSS v3.1. CVE-2026-0723: This vulnerability results from mishandling of validation responses used during double authentication. It would allow a malicious actor with account credentials to bypass two-factor authentication (2FA) by submitting falsified responses. This vulnerability is classified as high with a severity score of 7.4 according to CVSS v3.1. CVE-2025-13335: This vulnerability is caused by an infinite loop issue in Wiki redirects. Under certain conditions, an authenticated user could configure malformed Wiki documents that bypass cycle detection, causing a denial of service. It is classified as medium with a severity score of 6.5 according to CVSS v3.1. CVE-2026-1102: This vulnerability would allow a malicious actor to perform a denial of service on an affected system by repeatedly sending malformed SSH connection requests. It is classified as medium with a severity score of 5.3 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Compromise of user accounts;
- Data privacy breach;
- Data integrity breach;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- GitLab CE/EE versions prior to 18.6.4;
- GitLab CE/EE 18.7 versions prior to 18.7.2;
- GitLab CE/EE 18.8 versions prior to 18.8.2;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update GitLab CE/EE installations to versions 18.6.4, 18.7.2, or 18.8.2 or later;
- Check logs for suspicious exploitation activity prior to the update;
Sources & External Links
Vendor security advisories and documentation
- https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/
- https://www.thehackerwire.com/vulnerability/CVE-2025-13927/
- https://www.thehackerwire.com/vulnerability/CVE-2026-0723/
- https://nvd.nist.gov/vuln/detail/CVE-2025-13928
- https://app.opencve.io/cve/CVE-2025-13335
- https://www.thehackerwire.com/vulnerability/CVE-2026-1102/
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.