BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

GitLab

GitLab Security Releases - April 2026

gitlab-2026-04 Apr 1, 2026 Source: Vendor

GitLab security advisories for April 2026: 21 CVEs, 13 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

21 lines
All 21 CVEs 21 Additional recognition 0 Unclaimed only
Showing 1–21 of 21
CVE-2025-0186 BR2026-0000-032024 unclaimed
Denial of Service issue in discussions endpoint impacts GitLab CE/EE
Credited as pwnie
CVE-2025-12664 BR2026-0000-032025 unclaimed
Denial of Service issue in GraphQL API impacts GitLab CE/EE
Credited as foxribeye
CVE-2025-3922 BR2026-0000-032026 unclaimed
Denial of Service issue in GraphQL API impacts GitLab CE/EE
Credited as pwnie
CVE-2025-6016 BR2026-0000-032027 unclaimed
Denial of Service issue in notes endpoint impacts GitLab CE/EE
Credited as pwnie
CVE-2025-9484 BR2026-0000-032028 unclaimed
Information Disclosure issue in certain GraphQl query impacts GitLab EE
Credited as mateuszek
CVE-2025-9957 BR2026-0000-032029 unclaimed
Improper Access Control issue in project fork relationship API impacts GitLab CE/EE
Credited as theluci
CVE-2026-1092 BR2026-0000-032030 unclaimed
Denial of Service issue in Terraform state lock API impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1101 BR2026-0000-032031 unclaimed
Denial of Service issue in GraphQL SBOM API impacts GitLab EE
Credited as sim4n6
CVE-2026-1403 BR2026-0000-032032 unclaimed
Denial of Service issue in CSV import impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1516 BR2026-0000-032033 unclaimed
Code Injection issue in Code Quality reports impacts GitLab EE
Credited as maksyche
CVE-2026-1660 BR2026-0000-032034 unclaimed
Denial of Service issue in Jira import impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1752 BR2026-0000-032035 unclaimed
Improper Access Control issue in Environments API impacts GitLab EE
Credited as modhanami
CVE-2026-2104 BR2026-0000-032036 unclaimed
Information Disclosure issue in CSV export impacts GitLab CE/EE
Credited as ahacker1
CVE-2026-2619 BR2026-0000-032037 unclaimed
Incorrect Authorization issue in vulnerability flags AI detection API impacts GitLab EE
Credited as sage_cyberlord
CVE-2026-3254 BR2026-0000-032038 unclaimed
Improper Restriction of Rendered UI Layers or Frames issue in Mermaid sandbox impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-4332 BR2026-0000-032039 unclaimed
Cross-site Scripting issue in analytics dashboards impacts GitLab EE
Credited as go7f0
CVE-2026-4916 BR2026-0000-032040 unclaimed
Missing Authorization issue in custom role permissions impacts GitLab CE/EE
Credited as theluci
CVE-2026-4922 BR2026-0000-032041 unclaimed
Cross-Site Request Forgery issue in GraphQL API impacts GitLab CE/EE
Credited as ahacker1
CVE-2026-5262 BR2026-0000-032042 unclaimed
Cross-site Scripting issue in Storybook impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-5377 BR2026-0000-032043 unclaimed
Improper Access Control issue in issue description renderer impacts GitLab CE/EE
Credited as yvvdwf
CVE-2026-5816 BR2026-0000-032044 unclaimed
Improper Resolution of Path Equivalence issue in Web IDE asset impacts GitLab CE/EE
Credited as joaxcar