BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

GitLab

GitLab Security Releases - August 2026

gitlab-2026-08 Aug 1, 2026 Source: Vendor

GitLab security advisories for August 2026: 21 CVEs, 17 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

21 lines
All 21 CVEs 21 Additional recognition 0 Unclaimed only
Showing 1–21 of 21
CVE-2025-10903 BR2026-0000-032560 unclaimed
Denial of Service issue in SCIM API impacts GitLab EE
Credited as rafabd1
CVE-2025-9486 BR2026-0000-032561 unclaimed
Incorrect Privilege Assignment issue in custom roles impacts GitLab EE
Credited as mateuszek
CVE-2026-10053 BR2026-0000-032562 unclaimed
Remote code execution via path traversal in package registry impacts GitLab CE/EE
Credited as invisiblemeerkat
CVE-2026-15216 BR2026-0000-032563 unclaimed
Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE
Credited as yvvdwf
CVE-2026-15217 BR2026-0000-032564 unclaimed
Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE
Credited as yvvdwf
CVE-2026-15387 BR2026-0000-032565 unclaimed
Improper Handling of Untrusted Data issue in Pipeline Execution Policies impacts GitLab EE
Credited as 3nvz
CVE-2026-15423 BR2026-0000-032566 unclaimed
Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE
Credited as sim4n6
CVE-2026-16494 BR2026-0000-032567 unclaimed
Missing Authorization issue in ProjectsController impacts GitLab EE
Credited as 3nvz
CVE-2026-16627 BR2026-0000-032568 unclaimed
Cross-site Scripting issue in CI manual job confirmation modal impacts GitLab CE/EE
Credited as 3nvz
CVE-2026-18252 BR2026-0000-032569 unclaimed
Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE
Credited as thwin_htet
CVE-2026-18433 BR2026-0000-032570 unclaimed
Incorrect Authorization issue in AI Tool Rules GraphQL resolver impacts GitLab EE
Credited as anshuman_bh
CVE-2026-19478 BR2026-0000-032571 unclaimed
Code Injection issue via GraphQL directive impacts GitLab CE/EE
Credited as hiimguardian
CVE-2026-19650 BR2026-0000-032572 unclaimed
Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE
Credited as kreep
CVE-2026-3035 BR2026-0000-032573 unclaimed
Improper Access Control issue in protected environments impacts GitLab EE
Credited as go7f0
CVE-2026-4398 BR2026-0000-032574 unclaimed
Authorization Bypass issue in compliance framework assignment impacts GitLab EE
Credited as bountyyfi
CVE-2026-4879 BR2026-0000-032575 unclaimed
Missing Authorization issue in external status check API impacts GitLab EE
Credited as jaykp
CVE-2026-6821 BR2026-0000-032576 unclaimed
Missing Authorization issue in merge requests API impacts GitLab EE
Credited as rogerace
CVE-2026-7427 BR2026-0000-032577 unclaimed
Denial of Service issue in GraphQL API JSON parser impacts GitLab CE/EE
Credited as aphantom
CVE-2026-7487 BR2026-0000-032578 unclaimed
Improper Authorization issue in merge request approval rules reset impacts GitLab EE
Credited as rogerace
CVE-2026-77801 BR2026-0000-032579 unclaimed
Denial of Service issue in import pipeline impacts GitLab CE/EE
Credited as Tran Ba Quang
CVE-2026-8667 BR2026-0000-032580 unclaimed
Incorrect Authorization issue in npm dist-tags endpoint impacts GitLab CE/EE
Credited as peppersghost