BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

GitLab

GitLab Security Releases - June 2026

gitlab-2026-06 Jun 1, 2026 Source: Vendor

GitLab security advisories for June 2026: 21 CVEs, 18 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

22 lines
All 22 CVEs 22 Additional recognition 0 Unclaimed only
Showing 1–22 of 22
CVE-2026-0934 BR2026-0000-032522 unclaimed
Improper Access Control issue in Protected Environments API impacts GitLab EE
Credited as vulnable
CVE-2026-10086 BR2026-0000-032523 unclaimed
Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE
Credited as yvvdwf
CVE-2026-10087 BR2026-0000-032524 unclaimed
Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE
Credited as yvvdwf
CVE-2026-10712 BR2026-0000-032525 unclaimed
Cross-site Scripting issue in Web IDE workbench asset handler impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-12053 BR2026-0000-032526 unclaimed
Information Disclosure issue in Duo Workflows impacts GitLab EE
Credited as 3nvz
CVE-2026-12053 BR2026-0000-032527 unclaimed
Information Disclosure issue in Duo Workflows impacts GitLab EE
Credited as GitLab team member Dennis Appelt
CVE-2026-1500 BR2026-0000-032528 unclaimed
Denial of Service issue in Group Placeholder Reassignments API impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1606 BR2026-0000-032529 unclaimed
Improper Input Validation issue in Snippets impacts GitLab CE/EE
Credited as st4nly0n
CVE-2026-2238 BR2026-0000-032530 unclaimed
Improper Authorization issue in Rapid Diffs impacts GitLab CE/EE
Credited as modhanami
CVE-2026-3176 BR2026-0000-032531 unclaimed
Missing Authorization issue in Security Dashboard impacts GitLab EE
Credited as modestia
CVE-2026-3553 BR2026-0000-032532 unclaimed
Improper Access Control issue in Todos API impacts GitLab CE/EE
Credited as go7f0
CVE-2026-5309 BR2026-0000-032533 unclaimed
Authorization Bypass issue in Virtual Registry Cleanup Policy API impacts GitLab EE
Credited as go7f0
CVE-2026-5796 BR2026-0000-032534 unclaimed
Improper Access Control issue in group packages API impacts GitLab CE/EE
Credited as harshinsecurity
CVE-2026-5952 BR2026-0000-032535 unclaimed
Incorrect Authorization issue in Maven Package Registry impacts GitLab CE/EE
Credited as pkkr
CVE-2026-6269 BR2026-0000-032536 unclaimed
Improper Access Control issue in Merge Requests API impacts GitLab CE/EE
Credited as rogerace
CVE-2026-6277 BR2026-0000-032537 unclaimed
Improper Access Control issue in Security Inventory impacts GitLab EE
Credited as mateuszek
CVE-2026-6552 BR2026-0000-032538 unclaimed
Improper Access Control issue in Group SAML Identity API impacts GitLab EE
Credited as cyberjoker
CVE-2026-6976 BR2026-0000-032539 unclaimed
Authorization Bypass issue in Merge Request diff impacts GitLab CE/EE
Credited as xorz
CVE-2026-7250 BR2026-0000-032540 unclaimed
Denial of Service issue in Grape API JSON parsing middleware impacts GitLab CE/EE
Credited as svalkanov
CVE-2026-8589 BR2026-0000-032541 unclaimed
HTML injection issue in certain group setting fields impacts GitLab EE
Credited as go7f0
CVE-2026-9204 BR2026-0000-032542 unclaimed
Server-Side Request Forgery issue in Gitaly repository import impacts GitLab CE/EE
Credited as AndresAIFR
CVE-2026-9694 BR2026-0000-032543 unclaimed
Improper Neutralization issue in Service Desk email template impacts GitLab CE/EE
Credited as 3nvz