GitLab released security updates on June 10, 2026, patching 12 vulnerabilities across GitLab CE/EE and EE, including high-severity flaws that could enable full account takeover, arbitrary client-side code execution, and unauthenticated denial-of-service.
All self-managed administrators are strongly urged to upgrade to GitLab 19.0.2, 18.11.5, or 18.10.8 immediately.
The most alarming vulnerability in this release is CVE-2026-6552 (CVSS 8.7), an improper access control flaw in the Group SAML Identity API that affects GitLab EE versions from 15.5 onward.
GitLab Patches Multiple Flaws
Under exploitable conditions, an authenticated user with the Group Owner role can exploit authorization weaknesses in the SAML identity management workflow to hijack another group member’s GitLab account entirely without requiring the victim’s credentials.
Equally dangerous is CVE-2026-10087 (CVSS 8.7), a stored Cross-Site Scripting (XSS) vulnerability in the Analytics Dashboard.
An authenticated user holding Developer-level permissions can inject malicious client-side scripts that execute within a targeted user’s browser session due to insufficient input sanitization.
Successful exploitation opens the door to session hijacking, privilege escalation, and secondary account takeover, making this flaw a serious risk in multi-user GitLab environments. Both vulnerabilities were responsibly disclosed through GitLab’s HackerOne bug bounty program.
The third high-severity issue, CVE-2026-7250 (CVSS 7.5), is a Denial of Service flaw in the Grape API JSON parsing middleware affecting GitLab CE/EE all the way back to version 12.10.
Notably, this vulnerability requires no authentication; any remote attacker can send a specially crafted API request to crash the service.
A fourth high-severity bug, CVE-2026-8589 (CVSS 7.3), is an HTML injection vulnerability in group-setting fields that could allow an attacker to add unauthorized email addresses to a victim’s account, establishing a persistent account-compromise vector.
Among the medium-severity findings, CVE-2026-9204 (CVSS 5.3) introduces a Server-Side Request Forgery (SSRF) flaw in Gitaly repository imports, enabling an authenticated user to read arbitrary files from the Gitaly server and probe internal network resources.
CVE-2026-9694 (CVSS 2.6), while rated low, allows an unauthenticated attacker to impersonate the GitLab Support Bot by injecting arbitrary content through a crafted Service Desk email reply.
Here is the complete table of all CVEs
| CVE ID | Issue Type | CVSS | Severity |
|---|---|---|---|
| CVE-2026-6552 | Improper Access Control (SAML) | 8.7 | High |
| CVE-2026-10087 | Cross-Site Scripting (XSS) | 8.7 | High |
| CVE-2026-7250 | Denial of Service (API) | 7.5 | High |
| CVE-2026-8589 | HTML Injection / Email Abuse | 7.3 | High |
| CVE-2026-1500 | Denial of Service (File Upload) | 6.5 | Medium |
| CVE-2026-6269 | Improper Access Control (MR API) | 5.4 | Medium |
| CVE-2026-9204 | Server-Side Request Forgery (SSRF) | 5.3 | Medium |
| CVE-2026-10733 | HTML Injection / DoS (CI/CD Catalog) | 4.3 | Medium |
| CVE-2026-6277 | Improper Access Control (Security Inventory) | 4.3 | Medium |
| CVE-2026-6976 | Authorization Bypass (MR Diff) | 3.7 | Low |
| CVE-2026-3553 | Improper Access Control (Todos API) | 3.1 | Low |
| CVE-2026-9694 | Improper Neutralization / Impersonation | 2.6 | Low |
The patched releases GitLab 19.0.2, 18.11.5, and 18.10.8 bundle all security fixes alongside stability improvements, including updates to Ruby JWT dependencies, Rails components, Gitaly, and the Container Registry.
Administrators should note that this patch includes mandatory database migrations; single-node deployments will experience downtime during the upgrade, while multi-node environments can leverage GitLab’s zero-downtime upgrade procedures. Post-deploy migrations are included for versions 19.0.2 and 18.11.5.
Security teams are advised to upgrade without delay, audit logs for suspicious account or API activity across affected components particularly SAML identity management and Analytics Dashboard events and rotate sensitive credentials if exploitation of any of these vulnerabilities is suspected prior to patching.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
