GitLab patches multiple flaws including privilege escalation, XSS, and approval bypass

GitLab released security updates `17.10.1`, `17.9.3`, and `17.8.6` for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments. The company said GitLab.com had already been patched and GitLab Dedicated customers did not need to take action, but urged self-managed administrators to upgrade immediately because the release addressed several high- and medium-severity issues across the platform. The patched set includes two high-severity cross-site scripting flaws, a high-severity privilege persistence issue, and additional access control, resource consumption, and command injection weaknesses. GitLab linked the fixes to **CVE-2025-2255**, **CVE-2025-0811**, **CVE-2025-2242**, **CVE-2024-12619**, **CVE-2024-10307**, and **CVE-2024-9773**, and also disclosed a prompt injection issue in the Amazon Q integration that was still awaiting CVE assignment at the time of the release.

Oct 1, 2017

GitLab patches multiple flaws including XSS and GitLab EE authorization bypass

GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.

Dec 1, 2023

GitLab patches multiple vulnerabilities in self-managed Community and Enterprise editions

GitLab released patch versions **18.6.2**, **18.5.4**, and **18.4.6** for GitLab Community Edition and Enterprise Edition to fix multiple security flaws affecting self-managed deployments. The company said **GitLab.com** was already patched and **GitLab Dedicated** customers did not need to take action, while administrators running affected self-managed versions were urged to upgrade immediately. The fixes were tied to several CVE records, including `CVE-2025-12029`, `CVE-2025-12716`, `CVE-2025-8405`, and `CVE-2025-11984`. The patched issues included several **high-severity** vulnerabilities, such as cross-site scripting in Wiki and Swagger UI, improper encoding in vulnerability reports, and a denial-of-service condition in GraphQL endpoints. GitLab also addressed medium- and low-severity flaws involving WebAuthn, ExifTool processing, the Commit API, compliance frameworks, error messages, and merge request titles. The release included database migrations that could cause downtime on single-node deployments, although multi-node environments could use GitLab's zero-downtime upgrade procedures.

Dec 10, 2025

GitLab patches multiple flaws including privilege escalation, XSS, and approval bypass

How this story unfolded

GitLab releases 17.2.2, 17.1.4, and 17.0.6 security patches

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

GitLab patches multiple flaws including privilege escalation, XSS, and approval bypass

How this story unfolded

GitLab releases 17.2.2, 17.1.4, and 17.0.6 security patches

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

GitLab patches multiple flaws including privilege escalation, XSS, and approval bypass

How this story unfolded

GitLab releases 17.2.2, 17.1.4, and 17.0.6 security patches

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches XSS, privilege persistence, and command injection flaws

GitLab patches multiple flaws including XSS and GitLab EE authorization bypass

GitLab patches multiple vulnerabilities in self-managed Community and Enterprise editions

GitLab patches multiple flaws including privilege escalation, XSS, and approval bypass

How this story unfolded

GitLab releases 17.2.2, 17.1.4, and 17.0.6 security patches

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches XSS, privilege persistence, and command injection flaws

GitLab patches multiple flaws including XSS and GitLab EE authorization bypass

GitLab patches multiple vulnerabilities in self-managed Community and Enterprise editions