GitLab patches 11 flaws including account takeover and XSS in CE and EE
Patch & Detection Intelligence · 8 sources · Updated 4mo ago · First seen Jun 11, 2026
GitLab released 19.0.2, 18.11.5, and 18.10.8 for self-managed Community Edition and Enterprise Edition deployments to fix 11 security vulnerabilities and additional bugs, and urged administrators to upgrade immediately. The advisory says all versions before those releases are affected, while GitLab.com has already been patched and GitLab Dedicated customers do not need to take action. GitLab also warned that the update includes database migrations that may cause downtime on single-node instances, though multi-node environments can use zero-downtime upgrade procedures.
The most severe issue, CVE-2026-6552 (CVSS 8.7), is an improper authorization flaw in GitLab EE's Group SAML identity management that could let an authenticated group Owner take over another group member's account under certain conditions. GitLab also fixed CVE-2026-10087, an Analytics Dashboard cross-site scripting flaw in GitLab EE that could allow an authenticated developer to execute arbitrary client-side code in a victim's browser. The broader patch set addresses additional risks including denial of service in Grape API JSON parsing, SSRF, unauthorized access to confidential data, and other authorization bypasses, and government and vendor advisories have called on organizations to apply the patched versions.
