Loading story…
GitLab released security updates for self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) to fix a high-severity two-factor authentication (2FA) bypass and multiple denial-of-service (DoS) flaws. The most significant issue, CVE-2026-0723 (CVSS 7.4), is an unchecked return value weakness in authentication services that could allow an attacker with knowledge of a victim’s credential/account ID to bypass 2FA by submitting forged device responses.
GitLab also patched DoS vulnerabilities affecting unauthenticated and authenticated scenarios, including crafted malformed authentication data against the Jira Connect integration (CVE-2025-13927), incorrect authorization validation in API endpoints such as the Releases API (CVE-2025-13928), malformed Wiki documents that bypass cycle detection (CVE-2025-13335), and repeated malformed SSH authentication requests (CVE-2026-1102). Fixed releases are 18.8.2, 18.7.2, and 18.6.4; GitLab advised administrators to upgrade immediately, noting GitLab.com is already patched, while third-party tracking indicated thousands of exposed GitLab CE instances remain online and potentially at risk if unpatched.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In its advisory, GitLab warned self-managed customers to apply the new releases quickly because unpatched instances could face service disruption or account compromise. GitLab also stated that GitLab.com was already running patched code and that GitLab Dedicated customers did not need to take action.
GitLab issued security updates 18.8.2, 18.7.2, and 18.6.4 for self-managed Community Edition and Enterprise Edition instances to fix multiple vulnerabilities. The patched issues include CVE-2026-0723, a high-severity two-factor authentication bypass flaw, along with four denial-of-service vulnerabilities affecting Jira Connect, the Releases API, Wiki redirects, and SSH authentication handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released patched Community Edition and Enterprise Edition versions `18.8.2`, `18.7.2`, and `18.6.4` to remediate five disclosed vulnerabilities affecting self-managed deployments. The fixes include a high-severity two-factor authentication bypass issue and four denial-of-service flaws, two rated high severity and two rated medium severity. Related CVE records were published for `CVE-2026-0723`, `CVE-2025-13927`, `CVE-2026-1102`, `CVE-2025-13335`, and `CVE-2025-13928`. GitLab said GitLab.com was already running the patched version and that GitLab Dedicated customers did not need to take action, but urged self-managed customers to upgrade immediately. The company also warned that the patch release includes database migrations that can cause downtime on single-node instances unless operators use zero-downtime upgrade procedures in multi-node environments.
Jul 24, 2026
GitLab released security updates `18.8.4`, `18.7.4`, and `18.6.6` for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments, and urged customers to upgrade immediately. The most severe issue, **CVE-2025-7659** with CVSS `8.0`, is an incomplete validation flaw in the Web IDE that could allow an unauthenticated attacker to steal tokens and gain access to private repositories. GitLab.com had already been patched, and GitLab Dedicated customers were not required to take action. The release also addressed additional vulnerabilities tracked as **CVE-2025-8099**, **CVE-2026-0958**, **CVE-2026-0595**, and **CVE-2025-14560**, covering several denial-of-service conditions, cross-site scripting, HTML injection, server-side request forgery, and authorization bypasses across GitLab CE/EE and EE. GitLab said the patch release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid downtime by following zero-downtime upgrade procedures.
Jul 24, 2026
GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.
Jul 24, 2026