CVE catalog

CVE-2026-6896

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticat

[CVE catalog]

Severity
High · CVSS 8.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpegitlabNot reported18.11.7fixed
CpegitlabNot reported19.0.4fixed
CpegitlabNot reported19.1.2fixed
Ubuntugitlab16.048.4.3+dfsg-9vulnerable
Ubuntugitlab16.048.4.3+dfsg-12vulnerable
Ubuntugitlab16.048.5.8+dfsg-5vulnerable
CpegitlabNot reported19.1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpegitlabcpeNot reported18.11.7Not reportedNot reportedNot reported
CpegitlabcpeNot reported19.0.4Not reportedNot reportedNot reported
CpegitlabcpeNot reported19.1.2Not reportedNot reportedNot reported
CpegitlabcpeNot reported19.1.2Not reportedNVD-CVE-2026-6896Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]