Multiple vulnerabilities affecting GitLab CE/EE
Multiple vulnerabilities have been discovered in GitLab CE/EE, allowing a malicious actor to compromise user accounts, execute client-side code in a victim's browser, and cause a denial of service remotely.
Description
Technical context and vulnerability details
GitLab Community Edition (CE) and Enterprise Edition (EE) are DevOps lifecycle management platforms enabling source code repository hosting, collaboration, and continuous integration/continuous deployment (CI/CD). These solutions are affected by several vulnerabilities labeled as follows: CVE-2026-6552: This vulnerability is due to insufficient authorization control within the Group SAML identity management mechanism. Exploitation of this vulnerability would allow an authenticated attacker with the Group Owner role to take control of the account of another member of the same group. It is classified high with a severity score of 8.7 according to CVSS v3.1. CVE-2026-10087: This vulnerability results from insufficient validation of user inputs in the Analytics Dashboard component. Exploitation of this vulnerability would allow an authenticated attacker with developer privileges to execute JavaScript code in a user's browser. It is classified high with a severity score of 8.7 according to CVSS v3.1. CVE-2026-7250: This vulnerability is caused by insufficient input validation in the middleware responsible for parsing API requests. Exploitation of this vulnerability would allow an unauthenticated malicious actor to cause a denial of service affecting instance availability. It is classified high with a severity score of 7.5 according to CVSS v3.1. CVE-2026-8589: This vulnerability results from insufficient neutralization of user-supplied data in certain group configuration fields, allowing the injection of malicious HTML content (HTML Injection via XSS). Exploitation of this vulnerability would allow an authenticated attacker to associate unauthorized email addresses with a targeted user's account. It is classified high with a severity score of 7.3 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Compromise of user accounts;
- Execution of arbitrary javascript code in a victim's browser;
- Denial of service;
- Unauthorized modification of information associated with user accounts;
- Breach of confidentiality and data integrity;
Affected systems
Products, components and targeted versions
- CVE-2026-6552: GitLab EE versions 15.5 to 18.10.7, 18.11 to 18.11.4 and 19.0 to 19.0.1;
- CVE-2026-10087: GitLab EE versions 17.1 to 18.10.7, 18.11 to 18.11.4 and 19.0 to 19.0.1;
- CVE-2026-7250: GitLab CE/EE versions 12.10 to 18.10.7, 18.11 to 18.11.4 and 19.0 to 19.0.1;
- CVE-2026-8589: GitLab EE versions 13.1.4 to 18.10.7, 18.11 to 18.11.4 and 19.0 to 19.0.1;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Gitlab CE/EE to its latest stable version depending on the deployed branch;
- Ensure application of the principle of least privilege;
- Review audit logs to detect any abnormal changes to accounts, SAML identities, and group settings;
Sources & External Links
Vendor security advisories and documentation
- https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-2-released/
- https://nvd.nist.gov/vuln/detail/CVE-2026-6552
- https://nvd.nist.gov/vuln/detail/CVE-2026-10087
- https://nvd.nist.gov/vuln/detail/CVE-2026-7250
- https://nvd.nist.gov/vuln/detail/CVE-2026-8589
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.