GitLab patches Web IDE XSS and multiple flaws in CE and EE

GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.

Dec 1, 2023

GitLab patches five flaws including high-severity XSS in CE and EE

GitLab released security updates for self-managed GitLab Community Edition and Enterprise Edition, publishing versions **17.9.1**, **17.8.4**, and **17.7.6** to fix five vulnerabilities and urging administrators to upgrade immediately. The issues include two high-severity cross-site scripting flaws tracked as **`CVE-2025-0475`** and **`CVE-2025-0555`**, along with three medium-severity authorization or injection weaknesses identified as **`CVE-2024-8186`**, **`CVE-2024-10925`**, and **`CVE-2025-0307`**. GitLab said **GitLab.com** was already running the patched version and that **GitLab Dedicated** customers did not need to take action, leaving self-managed deployments as the primary exposure point. The fixes apply across multiple supported release lines, and the vendor framed the update as an urgent security patch cycle for affected CE and EE installations.

Feb 26, 2025

GitLab patches high-severity XSS and other flaws in CE and EE

GitLab released **19.1.2**, **19.0.4**, and **18.11.7** to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, **`CVE-2026-6896`**, is a **CWE-79** cross-site scripting vulnerability in GitLab EE that could let an authenticated user with **Developer** privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from **13.11** before **18.11.7**, **19.0** before **19.0.4**, and **19.1** before **19.1.2**. The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said **GitLab.com** was already patched and **GitLab Dedicated** customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.

Jul 9, 2026

GitLab patches Web IDE XSS and multiple flaws in CE and EE

How this story unfolded

GitLab releases security patches for multiple CE/EE versions

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

GitLab patches Web IDE XSS and multiple flaws in CE and EE

How this story unfolded

GitLab releases security patches for multiple CE/EE versions

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

GitLab patches Web IDE XSS and multiple flaws in CE and EE

How this story unfolded

GitLab releases security patches for multiple CE/EE versions

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches multiple flaws including XSS and GitLab EE authorization bypass

GitLab patches five flaws including high-severity XSS in CE and EE

GitLab patches high-severity XSS and other flaws in CE and EE

GitLab patches Web IDE XSS and multiple flaws in CE and EE

How this story unfolded

GitLab releases security patches for multiple CE/EE versions

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

GitLab patches multiple flaws including XSS and GitLab EE authorization bypass

GitLab patches five flaws including high-severity XSS in CE and EE

GitLab patches high-severity XSS and other flaws in CE and EE