Multiple vulnerabilities affecting GitLab CE and EE

GitLab Community Edition (CE) and Enterprise Edition (EE) are DevOps lifecycle management platforms enabling source code repository hosting, collaboration, and continuous integration/continuous deployment (CI/CD). These solutions are affected by several vulnerabilities labeled as follows: CVE-2026-5173: This vulnerability arises from improper access control within WebSocket connections. Exploitation of this vulnerability could allow an authenticated attacker to invoke unintended server-side methods, potentially leading to unauthorized actions on the instance. This vulnerability is classified as high with a severity score of 8.5 according to CVSS v3.1. CVE-2026-1092: This vulnerability results from insufficient input validation when processing JSON payloads. Exploitation of this vulnerability would allow an unauthenticated malicious actor to cause a denial of service (DoS) of the affected system. This vulnerability is classified as high with a severity score of 7.5 according to CVSS v3.1. CVE-2025-12664: This vulnerability is caused by improper handling of repeated GraphQL queries. Exploitation of this vulnerability would allow an unauthenticated malicious actor to saturate server resources in order to cause a denial of service. This vulnerability is classified as high with a severity score of 7.5 according to CVSS v3.1.

• CVE-2026-5173: GitLab CE/EE versions 16.9.6 to 18.8.8, 18.9 to 18.9.4, and 18.10 to 18.10.2;
• CVE-2026-1092: GitLab CE/EE versions 12.10 to 18.8.8, 18.9 to 18.9.4, and 18.10 to 18.10.2;
• CVE-2025-12664: GitLab CE/EE versions 13.0 to 18.8.8, 18.9 to 18.9.4, and 18.10 to 18.10.2;

RECOMMENDED ACTIONS:

• Update GitLab CE/EE to its latest stable version depending on the branch used;