CVE-2026-3855

GitLab CE/EE versions 18.2.7 before 19.1.8 , 19.2 before 19.2.6 , and 19.3 before 19.3.2 are vulnerable to an issue in the Terraform state upload functionality . Due to improper validation of parameters, an authenticated user with project-level permissions could, under certain conditions, access ...

EUVD-2026-80120

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper...

CVE-2026-7514 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper...

CVE-2026-7514

CVE-2026-7514 is a missing authorization vulnerability in the Generic Package Registry of GitLab CE/EE , affecting versions 13.9 through before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . An authenticated user with developer-role permissions could substitute package file content and hide...

CVE-2026-8030 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-8030

CVE-2026-8030 is a Missing Authorization vulnerability in GitLab CE/EE affecting versions 13.0 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1 . The root cause is improper validation of group URL slugs during namespace transfers , which under certain conditions allowed an authenticat...

EUVD-2026-80119

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-16794 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

EUVD-2026-80118

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

CVE-2026-16794 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

CVE-2026-16794

GitLab EE is affected by a missing authorization flaw in compliance framework management . Under certain conditions, an authenticated user holding the Security Manager role could execute arbitrary CI/CD jobs and access protected variables within group projects. The root cause is improper authoriz...

CVE-2026-16794 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

EUVD-2026-80117

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-19619

CVE-2026-19619 affects GitLab CE/EE versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The vulnerability is a cross-site scripting (XSS) flaw caused by improper sanitization of pasted HTML content in the Content Editor . Under certain conditions, an unauthenticated attacker ...

EUVD-2026-80222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-78252 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

EUVD-2026-80221

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-79708

CVE-2026-79708 is an incorrect authorization flaw in GitLab EE affecting versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Due to insufficient scope validation , an authenticated user with developer permissions could execute a policy test pipeline on projects within their g...

CVE-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...