GitLab patches token theft, DoS, XSS, SSRF, and auth bypass flaws
Patch & Detection Intelligence · 6 sources · Updated 3mo ago · First seen Jan 24, 2012
GitLab released security updates 18.8.4, 18.7.4, and 18.6.6 for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments, and urged customers to upgrade immediately. The most severe issue, CVE-2025-7659 with CVSS 8.0, is an incomplete validation flaw in the Web IDE that could allow an unauthenticated attacker to steal tokens and gain access to private repositories. GitLab.com had already been patched, and GitLab Dedicated customers were not required to take action.
The release also addressed additional vulnerabilities tracked as CVE-2025-8099, CVE-2026-0958, CVE-2026-0595, and CVE-2025-14560, covering several denial-of-service conditions, cross-site scripting, HTML injection, server-side request forgery, and authorization bypasses across GitLab CE/EE and EE. GitLab said the patch release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid downtime by following zero-downtime upgrade procedures.
