Multiple GitLab CE/EE Vulnerabilities in 18.x Versions
Multiple security vulnerabilities affecting GitLab Community Edition (CE) and Enterprise Edition (EE) prior to patch releases 18.7.1, 18.6.3, and 18.5.5 were fixed in January 2026. These include stored XSS, missing authorization checks, denial of service conditions, insufficient access control, and data leakage.
Description
GitLab CE and EE contain several vulnerabilities due to improper input validation, missing authorization checks, and insecure handling of user content and API requests. A remote attacker could exploit these by sending specially crafted requests or persuading authenticated users to interact with malicious content, leading to cross-site scripting, unauthorized access, denial of service, sensitive information disclosure, or manipulation of sensitive settings.