GitLab patches five flaws including high-severity XSS in CE and EE

GitLab released **19.1.2**, **19.0.4**, and **18.11.7** to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, **`CVE-2026-6896`**, is a **CWE-79** cross-site scripting vulnerability in GitLab EE that could let an authenticated user with **Developer** privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from **13.11** before **18.11.7**, **19.0** before **19.0.4**, and **19.1** before **19.1.2**. The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said **GitLab.com** was already patched and **GitLab Dedicated** customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.

Jul 9, 2026

GitLab patches Web IDE XSS and multiple flaws in CE and EE

GitLab released patched Community Edition and Enterprise Edition versions **17.0.1**, **16.11.3**, and **16.10.6** to fix multiple security vulnerabilities and bug issues, and urged self-managed customers to upgrade immediately. The most severe issue was a high-severity cross-site scripting flaw in the Web IDE that could enable **one-click account takeover**, alongside additional medium-severity weaknesses affecting denial of service, CSRF protections, authorization controls, and information disclosure. The release is associated with several tracked vulnerabilities, including **`CVE-2024-5258`**, **`CVE-2023-7045`**, **`CVE-2024-4835`**, and **`CVE-2024-2874`**. GitLab said **GitLab.com** was already running the patched version when the advisory was published, and the notice also referenced mitigations related to a **PDF.js** vulnerability and an update for **Mattermost** as part of the broader security response.

Apr 25, 2024

GitLab patches high-severity XSS and authorization bypass flaws in CE/EE

GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.

Aug 13, 2026

GitLab patches five flaws including high-severity XSS in CE and EE

How this story unfolded

GitLab releases patches for five security vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

GitLab patches five flaws including high-severity XSS in CE and EE

How this story unfolded

GitLab releases patches for five security vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

GitLab patches five flaws including high-severity XSS in CE and EE

How this story unfolded

GitLab releases patches for five security vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches high-severity XSS and other flaws in CE and EE

GitLab patches Web IDE XSS and multiple flaws in CE and EE

GitLab patches high-severity XSS and authorization bypass flaws in CE/EE

GitLab patches five flaws including high-severity XSS in CE and EE

How this story unfolded

GitLab releases patches for five security vulnerabilities

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches high-severity XSS and other flaws in CE and EE

GitLab patches Web IDE XSS and multiple flaws in CE and EE

GitLab patches high-severity XSS and authorization bypass flaws in CE/EE