Loading story…
GitLab released patched Community Edition and Enterprise Edition versions 19.2.2, 19.1.4, and 19.0.6 to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade.
The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as CVE-2026-15216 and CVE-2026-15217, each with a CVSS score of 8.7, affecting GitLab CE/EE versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. GitLab also fixed CVE-2026-19228, an authorization bypass issue in GitLab EE with a CVSS score of 8.5, affecting 19.1 before 19.1.4 and 19.2 before 19.2.2, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-15423 was disclosed on August 12, 2026 as a high-severity GitLab CI/CD pipeline API vulnerability. GitLab said the flaw could let a developer-level user run a pipeline on a protected branch without required push permission under certain conditions, and fixed it in versions 19.2.2, 19.1.4, and 19.0.6.
CVE-2026-19228 was published on August 12, 2026 as a high-severity authorization bypass vulnerability in GitLab EE. GitLab said the flaw could let an authenticated user cause AI usage to be attributed to another namespace and affects versions 19.1 before 19.1.4 and 19.2 before 19.2.2.
CVE-2026-15216 was published on August 12, 2026 as a high-severity cross-site scripting vulnerability in GitLab CE/EE involving Analytics Dashboards pagination controls. GitLab reported the flaw affects versions 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 and recommended upgrading to fixed versions.
CVE-2026-15217 was published on August 12, 2026 as a high-severity cross-site scripting flaw in GitLab CE/EE Analytics Dashboards table field configuration. GitLab said the issue affects versions 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2, and has been remediated in the patched releases.
On August 12, 2026, GitLab released GitLab CE/EE versions 19.2.2, 19.1.4, and 19.0.6 with security and bug fixes, and urged self-managed customers to upgrade immediately. The release addressed multiple vulnerabilities including high-severity XSS and authorization flaws, while GitLab.com was already running the patched version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourceacn.gov.it
Open sourcecirt.gy
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released **19.1.2**, **19.0.4**, and **18.11.7** to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, **`CVE-2026-6896`**, is a **CWE-79** cross-site scripting vulnerability in GitLab EE that could let an authenticated user with **Developer** privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from **13.11** before **18.11.7**, **19.0** before **19.0.4**, and **19.1** before **19.1.2**. The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said **GitLab.com** was already patched and **GitLab Dedicated** customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.
Jul 9, 2026
GitLab released security updates for self-managed GitLab Community Edition and Enterprise Edition, publishing versions **17.9.1**, **17.8.4**, and **17.7.6** to fix five vulnerabilities and urging administrators to upgrade immediately. The issues include two high-severity cross-site scripting flaws tracked as **`CVE-2025-0475`** and **`CVE-2025-0555`**, along with three medium-severity authorization or injection weaknesses identified as **`CVE-2024-8186`**, **`CVE-2024-10925`**, and **`CVE-2025-0307`**. GitLab said **GitLab.com** was already running the patched version and that **GitLab Dedicated** customers did not need to take action, leaving self-managed deployments as the primary exposure point. The fixes apply across multiple supported release lines, and the vendor framed the update as an urgent security patch cycle for affected CE and EE installations.
Jul 24, 2026
GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.
Jul 24, 2026