GitLab patches five vulnerabilities including 2FA bypass and DoS flaws

GitLab released patched Community Edition and Enterprise Edition versions 18.8.2, 18.7.2, and 18.6.4 to remediate five disclosed vulnerabilities affecting self-managed deployments. The fixes include a high-severity two-factor authentication bypass issue and four denial-of-service flaws, two rated high severity and two rated medium severity. Related CVE records were published for CVE-2026-0723, CVE-2025-13927, CVE-2026-1102, CVE-2025-13335, and CVE-2025-13928.

GitLab said GitLab.com was already running the patched version and that GitLab Dedicated customers did not need to take action, but urged self-managed customers to upgrade immediately. The company also warned that the patch release includes database migrations that can cause downtime on single-node instances unless operators use zero-downtime upgrade procedures in multi-node environments.