GitLab GitLab Version Control Server

Known Exploited GitLab Vulnerabilities

The following GitLab vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

The vulnerability CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability is in the top 1% of the currently known exploitable vulnerabilities. 2 known exploited GitLab vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 112 vulnerabilities in GitLab with an average score of 5.9 out of ten. Last year, in 2025 GitLab had 162 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in GitLab in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.16

Recent GitLab Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-12669	May 14, 2026	GitLab CE/EE HTML/JS injection via email notifications (15.11-18.11.X) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to inject HTML and JavaScript into email notifications sent to other users due to improper input sanitization.	GitLab
CVE-2025-13874	May 14, 2026	GitLab CE/EE <18.9.7: Guest Auth can View Unauthorized Issues GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.	GitLab
CVE-2025-14869	May 14, 2026	GitLab API DoS via crafted payloads 18.5-18.9.7, 18.10-18.10.6, 18.11-18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.	GitLab
CVE-2025-14870	May 14, 2026	GitLab CE/EE DoS via crafted JSON before 18.9.7, 18.10.6, 18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.	GitLab
CVE-2026-1184	May 14, 2026	GitLab EE <18.9.7 -> DOS via Crafted File Upload GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.	GitLab
CVE-2026-1322	May 14, 2026	GitLab AuthZ:OAuth Users Create Issues (v16<18.9.7,18.10<18.10.6,18.11<18.11.3) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.	GitLab
CVE-2026-1338	May 14, 2026	Auth-Role Dev Tag Delete Flaw, GitLab <=18.9.7,18.10<=18.10.6,18.11<=18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks.	GitLab
CVE-2026-1659	May 14, 2026	GitLab CE/EE DoS via Input Validation, vulnerable before 18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.	GitLab
CVE-2026-2900	May 14, 2026	GitLab EE Auth Bypass: Approval Rules (16.1018.9.6, 18.1018.10.5, 18.1118.11.2) GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.	GitLab
CVE-2026-3073	May 14, 2026	GitLab CE/EE PyPI Upload Auth Bypass before 18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.	GitLab
CVE-2026-3074	May 14, 2026	GitLab CE/EE 16.7-18.9.7 Unauth Access to Private Debug Symbols GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to download private debugging symbols from inaccessible projects due to improper access control.	GitLab
CVE-2026-3160	May 14, 2026	GitLab CE/EE Jira integration filter bypass before 18.9.7/18.10.6/18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.	GitLab
CVE-2026-3607	May 14, 2026	GitLab Access Control Bypass CVE-2026-3607 (before 18.9.7, 18.10.6, 18.11.3) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.	GitLab
CVE-2026-4524	May 14, 2026	GitLab CE/EE auth bypass: Conf Issue Access (v18.9.1-18.9.6, 18.10-18.10.5, 18.11-18.11.2) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.	GitLab
CVE-2026-4527	May 14, 2026	GitLab Unauth Jira Subscription via CSRF 11.10-18.9.7/18.10-18.10.6/18.11-18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.	GitLab
CVE-2026-6063	May 14, 2026	GitLab EE Authenticated Dev Users Delete Code Owner Rules (V11-18.11) GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.	GitLab
CVE-2026-6073	May 14, 2026	GitLab EE XSS: Authenticated Users Execute JS before v18.9.7, v18.10.6, v18.11.3 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.	GitLab
CVE-2026-6335	May 14, 2026	GitLab 18 CE/EE XSS/Exec Remote Code in User Session via Sanitization Flaw GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.	GitLab
CVE-2026-6883	May 14, 2026	GitLab EE Auth Bypass in MR Approval via Orphaned Policy Cleanup (v15.718.11.3) GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.	GitLab
CVE-2026-7377	May 14, 2026	GitLab EE XSS via Analytics Dashboards before 18.9.7, 18.10.6, 18.11.3 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.	GitLab
CVE-2026-7471	May 14, 2026	GitLab EE 18.818.11 Auth Virtual Reg RCE via Invalid Upstream Validation GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.	GitLab
CVE-2026-7481	May 14, 2026	GitLab EE 16.4-18.9.7/18.10-18.10.6/18.11-18.11.3 XSS via Dev role GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.	GitLab
CVE-2026-8280	May 14, 2026	GitLab CE/EE memory exhaustion DoS before 18.9.7/18.10.6/18.11.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.	GitLab
CVE-2026-8144	May 14, 2026	GitLab CE/EE Authz Bypass: Project Member Enumeration (<15.1,<18.9.7,<18.10.6,<18.11.3) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.	GitLab
CVE-2026-3254	Apr 22, 2026	GitLab CE/EE 18.11: Auth User Load Unauth Content via Mermaid Sandbox GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox.	GitLab
CVE-2026-4922	Apr 22, 2026	GitLab unauth GraphQL CSRF (v < 18.9.6 / 18.10.4 / 18.11.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.	GitLab
CVE-2025-0186	Apr 22, 2026	GitLab CE/EE DoS via crafted endpoint (v10.6-18.9.5/18.10-18.10.3/18.11-18.11.0) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint.	GitLab
CVE-2025-3922	Apr 22, 2026	GitLab CE/EE DoS via GraphQL API before 18.9.6, 18.10.4, 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API.	GitLab
CVE-2025-6016	Apr 22, 2026	GitLab CE/EE Auth DoS via Notes Retrieval before 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.	GitLab
CVE-2025-9957	Apr 22, 2026	Auth Bypass via Group Fork Prevention in GitLab CE/EE 11.2+ to 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper authorization checks.	GitLab
CVE-2026-1660	Apr 22, 2026	GitLab CE/EE DoS from Issue Import Input Validation up to 18.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.	GitLab
CVE-2026-5262	Apr 22, 2026	GitLab <=18.11.1 Storybook token disclosure to unauthenticated user GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.	GitLab
CVE-2026-5377	Apr 22, 2026	GitLab <=18.11.1 Improper ACL in Issue Render GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process.	GitLab
CVE-2026-5816	Apr 22, 2026	GitLab CE/EE XSS via Path Validation (18.10<18.10.4, 18.11<18.11.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.	GitLab
CVE-2026-6515	Apr 22, 2026	GitLab Virtual Registry Credential Escalation 18.218.11.1 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.	GitLab
CVE-2025-9484	Apr 08, 2026	GitLab EE Authenticated GraphQL Email Disclosure CVE-2025-9484 (v16.6-18.9.4) GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.	GitLab
CVE-2025-12664	Apr 08, 2026	GitLab 13.0-18.10.3 GraphQL DoS via repeated queries GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.	GitLab
CVE-2026-1092	Apr 08, 2026	GitLab CE/EE 12.10-18.10 DoS via JSON Validation GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.	GitLab
CVE-2026-1101	Apr 08, 2026	GitLab EE Authenticated GraphQL DoS (18.218.10) GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.	GitLab
CVE-2026-1516	Apr 08, 2026	GitLab EE <=18.10.3 Authenticated IP Leak via Code Quality Reports GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content.	GitLab
CVE-2026-1752	Apr 08, 2026	GitLab EE Auth Bypass v11.318.8.9, v18.918.9.5, v18.1018.10.3 GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.	GitLab
CVE-2026-2104	Apr 08, 2026	GitLab CE/EE Auth Bypass for CSV Export of Confidential Issues (v18.2-18.10) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.	GitLab
CVE-2026-2619	Apr 08, 2026	GitLab EE Priv Escal: Auditor edits vuln data (v18.6-18.8.9,18.9-18.9.5,18.10-18.10.3) GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.	GitLab
CVE-2026-4332	Apr 08, 2026	GitLab EE 18.2-18.10 XSS in Analytics Dashboards (before 18.8.9/18.9.5/18.10.3) GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.	GitLab
CVE-2026-4916	Apr 08, 2026	GitLab CE/EE Privilege Escalation 18.2-18.8.8, 18.9-18.9.4, 18.10-18.10.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization checks on member management operations.	GitLab
CVE-2026-5173	Apr 08, 2026	GitLab WebSocket IAC 16.9.6-18.10.3 (CVE-2026-5173) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.	GitLab
CVE-2026-2370	Mar 29, 2026	GitLab Improper Auth Jira Connect creds leak v14.318.8.6/18.918.9.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.	GitLab
CVE-2025-13078	Mar 25, 2026	GitLab CE/EE <=18.10.1 DoS via excessive webhook config (CVE-2025-13078) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.	GitLab
CVE-2025-13436	Mar 25, 2026	GitLab CE/EE before 18.10.1: Authenticated CI Input DoS via Resource Exhaustion GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.	GitLab
CVE-2025-14595	Mar 25, 2026	GitLab EE <=18.10.1 Improper Access Control (Planner) CVE-2025-14595 GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control	GitLab