Multiple vulnerabilities affecting GitLab CE and EE

GitLab Community Edition (CE) and Enterprise Edition (EE) are DevOps lifecycle management platforms enabling source code repository hosting, collaboration, and continuous integration/continuous deployment (CI/CD). These solutions are affected by several vulnerabilities labeled as follows: CVE-2026-5816: This is an improper resolution of path equivalence vulnerability. It results from a failure to validate file paths. Exploitation of this vulnerability would allow an unauthenticated attacker to execute arbitrary JavaScript code in a user's browser. This vulnerability is classified as high with a severity score of 8.0 according to CVSS v3.1. CVE-2026-5262: This is a Cross-Site Scripting (XSS) vulnerability, resulting from insufficient input validation. Exploitation of this vulnerability would allow an unauthenticated attacker to access sensitive tokens in the Storybook development environment. This vulnerability is classified as high with a severity score of 8.0 according to CVSS v3.1. CVE-2026-4922: Classified as a CSRF (Cross-Site Request Forgery) vulnerability, it is due to insufficient CSRF protection on the /api/graphql entry point. Exploitation of this vulnerability would allow an unauthenticated attacker to execute GraphQL mutations in place of authenticated users. This vulnerability is classified as high with a severity score of 8.1 according to CVSS v3.1. CVE-2026-5377: This improper authorization vulnerability results from improper access control during the ticket description rendering process. Exploitation of this vulnerability would allow an authenticated attacker to access confidential or private ticket titles within public projects. This vulnerability is classified as medium with a severity score of 4.3 according to CVSS v3.1. CVE-2026-6515: This is an insufficient session timeout vulnerability. It results from a defect in the validation of virtual register credentials. Exploitation of this vulnerability would allow an authenticated attacker to reuse normally expired or restricted sessions or tokens to gain unauthorized access to virtual registries. This vulnerability is classified as medium with a severity score of 5.4 according to CVSS v3.1. CVE-2026-1660: A denial of service (DoS) vulnerability, this vulnerability is due to incorrect input validation when importing tickets. Exploitation of this vulnerability would allow an authenticated malicious actor to cause a denial of service. This vulnerability is classified as medium with a severity score of 6.5 according to CVSS v3.1. CVE-2025-6016: This is a denial of service (DoS) vulnerability caused by inappropriate management of resource quotas during grade retrieval. Exploitation of this vulnerability would allow an authenticated malicious actor to cause a denial of service. This vulnerability is classified as medium with a severity score of 6.5 according to CVSS v3.1. CVE-2025-3922: This denial of service (DoS) vulnerability results from a lack of restrictions when allocating resources in the GraphQL API. Exploitation of this vulnerability would allow an authenticated attacker to cause a denial of service by overloading system resources. This vulnerability is classified as medium with a severity score of 6.5 according to CVSS v3.1. CVE-2025-0186: Classified as a denial of service (DoS) vulnerability, it results from an absence of resource limitation mechanisms. Exploitation of this vulnerability would allow an authenticated attacker to cause a denial of service by making specially crafted requests to a chat endpoint. This vulnerability is classified as medium with a severity score of 6.5 according to CVSS v3.1.

• GitLab CE/EE versions prior to 18.9.6;
• GitLab CE/EE 18.10.x versions prior to 18.10.4;
• GitLab CE/EE 18.11.x versions prior to 18.11.1;