widely-deployed-product-advisoryinternet-facing-service-vulnerabilityidentity-authentication-vulnerability

GitLab patches high-severity XSS and other flaws in CE and EE

Patch & Detection Intelligence · 3 sources · Updated 4mo ago · First seen Jul 8, 2026

GitLab released 19.1.2, 19.0.4, and 18.11.7 to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, CVE-2026-6896, is a CWE-79 cross-site scripting vulnerability in GitLab EE that could let an authenticated user with Developer privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.

The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said GitLab.com was already patched and GitLab Dedicated customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 8, 2026

Jul 8, 20264mo ago
GitLab details additional vulnerabilities fixed in July 8 security release
GitLab's July 8, 2026 security release was described as fixing eight vulnerabilities across Community Edition and Enterprise Edition, including CVE-2026-13320, an HTML injection flaw, plus issues involving repository mirroring credential exposure, private project metadata leakage, project existence inference, authorization weaknesses, and Git reference ambiguity. GitLab also said GitLab Dedicated customers were unaffected and that fuller disclosures would follow after 90 days.
Gitlab Patches Eight Security Vulnerabilities Across Community and Enterprise Edition
Jul 8, 20264mo ago
CVE-2026-6896 disclosed as GitLab XSS affecting developer-role users
CVE-2026-6896 was disclosed as an improper neutralization of input during web page generation issue in GitLab EE that could let an authenticated user with developer-role permissions execute arbitrary scripts in another user's browser under certain conditions. The issue affects releases from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2, and GitLab remediated it in the fixed releases.
CVE-2026-6896 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Jul 8, 20264mo ago
GitLab releases 19.1.2, 19.0.4, and 18.11.7 security patches
On 2026-07-08, GitLab released versions 19.1.2, 19.0.4, and 18.11.7 for Community Edition and Enterprise Edition to fix multiple security vulnerabilities and bug fixes. GitLab said GitLab.com was already patched and advised self-managed customers to upgrade immediately.
GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7 | GitLab Docs

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

8 linked

Incorrect Authorization in GitLab EE Compliance Violation Management (CVE-2026-6352)Improper authorization in GitLab EE repository mirroring credential access (CVE-2026-11827)Git reference name resolution ambiguity in GitLab CE/EE (CVE-2025-12506)Incorrect Authorization in GitLab EE Group-Level Settings (CVE-2026-13151)Missing Authorization in GitLab CE/EE cross-project reference pages (CVE-2026-7492)Cross-site scripting in GitLab EE vulnerability evidence table renderer (CVE-2026-6896)Improper Access Control in GitLab EE Work Items (CVE-2026-8472)HTML Injection in GitLab wiki markup rendering (CVE-2026-13320)

Affected products

2 linked

Gitlab Community EditionGitlab Enterprise Edition

Organizations

1 linked

GitLab

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Jul 9, 2026

Gitlab Patches Eight Security Vulnerabilities Across Community and Enterprise EditionOpen source ↗

Cvefeed High SeverityAdvisories · Jul 8, 2026

CVE-2026-6896 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabOpen source ↗

Docs GitlabNews · Nov 1, 2018

GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7 | GitLab DocsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News