Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Release: GitLab 19.3.6, 19.4.3, 19.5.1 Clear all filters
TI-2026-79055 CVE-2026-12664 · GHSA-g33c-grwm-jpgc

Incorrect authorization in GitLab lets read_api tokens create work items

Priority LOW 32

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a re…

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00395 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-863
TI-2026-79056 CVE-2026-13319 · GHSA-vpg2-vq38-j96f

Authorization bypass in GitLab group milestones API exposes private project data

Priority LOW 28

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including t…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00238 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-639
TI-2026-79057 CVE-2026-14288 · GHSA-xxf3-q32p-w3cc

Improper access control in GitLab bypasses merge request approval policy

Priority LOW 15

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a require…

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.0026 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-706
TI-2026-79058 CVE-2026-15723 · GHSA-92f3-3rm4-rcgv

LDAP injection in GitLab lets users take over LDAP-backed accounts

Priority LOW 38

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated…

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00543 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-90
TI-2026-79059 CVE-2026-16255 · GHSA-m22v-48hx-jv7m

Incorrect authorization in GitLab lets users bypass membership locks

Priority LOW 31

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticat…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00261 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-863
TI-2026-79060 CVE-2026-103515 · GHSA-x828-vfgm-5mgh

Incorrect Authorization in GitLab

Priority LOW 13

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authentica…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00232 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-863
TI-2026-79061 CVE-2026-105711 · GHSA-5jh8-pw64-jw5v

Sensitive cache content exposes confidential GitLab issue titles

Priority LOW 16

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue fro…

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00217 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-524
TI-2026-79062 CVE-2026-105777 · GHSA-3w94-rpmr-77jr

Sensitive information exposed in responses in GitLab

Priority LOW 29

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sen…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00277 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-201
TI-2026-79065 CVE-2026-112378 · GHSA-38rf-7hwj-5rg8

Use of less trusted source in GitLab allows paid AI feature access

Priority LOW 19

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00126 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-348
TI-2026-79063 CVE-2026-112212 · GHSA-f887-chxw-8674

Cache poisoning in GitLab OAuth/OIDC discovery redirects flows

Priority LOW 32

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shar…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.0019 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-444
TI-2026-79064 CVE-2026-112326 · GHSA-h7pg-g89w-v3vj

GitLab read-only users can delete vulnerability records

Priority LOW 15

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-on…

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00197 Published 2026-10-21 Fixed in 19.3.6, 19.4.3 +1 CWE-460