CVE-2026-103515, CVE-2026-105711, CVE-2026-105777 +9 more CVEs: GitLab 19.2 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1, 15.0 to before…

CVE-2026-103515

Affected technology

GitLab · 19.2 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls. Vendor/CNA’s CVSS 3.1 assessment (base score 2.7/10) rates confidentiality and availability impact as none; integrity impact as low.

CVE-2026-105711

Affected technology

GitLab · 15.0 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users. Vendor/CNA’s CVSS 3.1 assessment (base score 3.5/10) rates confidentiality impact as low; integrity and availability impact as none.

CVE-2026-105777

Affected technology

GitLab · 17.6.5 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers. Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none.

CVE-2026-110264

Affected technology

GitLab · 7.0 to before 18.11.13, 19.0 to before 19.0.10, 19.1 to before 19.1.9, 19.2 to before 19.2.9, 19.3 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Description’s affected range: versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run attacker-chosen code under the conditions described by the source. Vendor/CNA’s CVSS 3.1 assessment (base score 10.0/10) rates confidentiality, integrity and availability impact as high.

CVE-2026-112212

Affected technology

GitLab · 18.3 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as low.

CVE-2026-112326

Affected technology

GitLab · 17.8 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 3.1/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-112378

Affected technology

GitLab · 17.8 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-12664

Affected technology

GitLab · 18.2 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 6.8/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-13319

Affected technology

GitLab · 15.10 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-14288

Affected technology

GitLab · 17.4 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 3.1/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-15723

Affected technology

GitLab · 10.1 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking. Vendor/CNA’s CVSS 3.1 assessment (base score 8.2/10) rates confidentiality and integrity impact as high; availability impact as none.

CVE-2026-16255

Affected technology

GitLab · 12.0 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled. Vendor/CNA’s CVSS 3.1 assessment (base score 5.9/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.