Vulnerability

CERT-In Vulnerability Note CIVN-2026-0516
Multiple Vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)

Original Issue Date:October 22, 2026

Severity Rating: CRITICAL

Software Affected

GitLab CE/EE: all versions from 7.0 prior to 18.11.13.
GitLab CE/EE: versions 19.0 prior to 19.0.10.
GitLab CE/EE: versions 19.1 prior to 19.1.9.
GitLab CE/EE: versions 19.2 prior to 19.2.9.
GitLab CE/EE: versions 19.3 prior to 19.3.6.
GitLab CE/EE: versions 19.4 prior to 19.4.3.
GitLab CE/EE: versions 19.5 prior to 19.5.1.

Overview

Multiple vulnerabilities have been reported in GitLab Community Edition (CE) and Enterprise Edition (EE), which could allow an unauthenticated attacker to execute arbitrary code, take over user accounts, disclose sensitive information, bypass authorization mechanisms, modify access permissions, or disrupt the security and integrity of the targeted system.

Target Audience:
All end-user organizations and individuals using GitLab Community Edition (CE) and Enterprise Edition (EE).

Risk Assessment:
Critical risk of remote code execution, unauthorized access, sensitive information disclosure, bypass of security controls.

Impact Assessment:
Potential for remote code execution unauthorized access, sensitive information disclosure, and/or bypass of security controls.

Description

GitLab is a complete DevOps platform that provides source code management, CI/CD, and security features.

These vulnerabilities exist in GitLab CE/EE due to incorrect authorization, authorization bypass through user controlled key, use of incorrectly resolved name or reference, improper neutralization of special elements used in an LDAP query, use of cache containing sensitive information, insertion of sensitive information into sent data, integer overflow or wraparound, inconsistent interpretation of HTTP requests, improper clean up on thrown exception, and use of less trusted source. An attacker could exploit these vulnerabilities by submitting specially crafted regular expressions or requests, manipulating OAuth/OIDC discovery responses, or accessing functions without proper authorization.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, take over user accounts, disclose sensitive information, bypass authorization mechanisms, modify access permissions, or disrupt the security and integrity of the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

Vendor Information

GitLab
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

CVE Name
CVE-2026-12664
CVE-2026-13319
CVE-2026-14288
CVE-2026-15723
CVE-2026-16255
CVE-2026-103515
CVE-2026-105711
CVE-2026-105777
CVE-2026-110264
CVE-2026-112212
CVE-2026-112326
CVE-2026-112378

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India