techlist.io
KREN
gitlab

GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7 | GitLab Docs (opens in new tab)

gitlabgraphqloauthcross-site-scriptingclickhousehelmhtml-injectionrepository-mirroring

GitLab released patch versions 19.1.2, 19.0.4, and 18.11.7 on July 8, 2026, addressing multiple security vulnerabilities and bugs in CE and EE. GitLab strongly recommends that all affected self-managed installations upgrade immediately; GitLab.com is already patched, while GitLab Dedicated customers need no action. The release includes fixes ranging from cross-site scripting and HTML injection to authorization and credential-access issues.

Release Scope and Upgrade Guidance

  • Applies to GitLab Community Edition and Enterprise Edition.
  • Patch releases address security vulnerabilities and important bugs.
  • Scheduled patch releases occur twice monthly, on the second and fourth Wednesdays.
  • Vulnerability details are generally made public 90 days after the fixing release.
  • All self-managed deployments—including Omnibus, source, and Helm installations—should upgrade to the latest supported patch version.

High-Severity Browser Script Injection Fixes

  • CVE-2026-6896 — CVSS 8.7
    • Affected the vulnerability evidence table renderer in GitLab EE.
    • An authenticated developer could potentially execute scripts in another user’s browser through unsanitized input.
  • CVE-2026-13320 — CVSS 7.3
    • Affected wiki markup rendering in GitLab CE and EE.
    • Improper sanitization could allow an authenticated user to execute scripts in another user’s browser.

Authorization and Information Disclosure Fixes

  • CVE-2026-11827 — CVSS 4.9
    • Affected repository mirroring in GitLab EE.
    • Maintainers could potentially access credentials stored for another user because of inadequate authorization checks.
  • CVE-2026-8472 — CVSS 4.3
    • Affected work items in GitLab EE.
    • Users with minimal access could read metadata from work items in private projects.
  • CVE-2026-7492 — CVSS 4.3
    • Affected commit discussion display in GitLab CE and EE.
    • Unauthenticated users could determine whether a private project existed through cross-project references.

Repository and Configuration Security Fixes

  • CVE-2025-12506 — CVSS 3.5
    • Addressed ambiguous Git tag or branch references.
    • A repository could display content in the web interface that differed from the content available for download.
  • CVE-2026-13151 — CVSS 2.7
    • Fixed incorrect authorization in GitLab EE group-level settings.
    • Some authenticated users could modify settings beyond their intended permissions.
  • CVE-2026-6352 — CVSS 2.7
    • Fixed authorization flaws in compliance violation management.
    • Auditor-level users could modify compliance records through certain GraphQL operations.

Bug Fixes in GitLab 19.1.2

  • Set and backfilled organization_id for OAuth applications before constraint validation.
  • Upgraded Go to version 1.25.11.
  • Fixed multi-architecture tags on the legacy container registry path.
  • Improved external agent flows by using commit author and committer identities.
  • Fixed ClickHouse 23.x compatibility for ci_finished_builds.
  • Added cursor pagination and checkpoint limits to Duo workflow event retrieval.
  • Reverted a problematic merge request and removed an obsolete active-user cron schedule.
  • Fixed approval-rule regressions affecting Developer-authored merge requests.
  • Resolved a memory leak on the commits page caused by eager description loading.
  • Updated the builder image revision to 5.60.1.

Additional Fixes in GitLab 19.0.4

  • Backported the OAuth organization_id fixes.
  • Added Skopeo registry authentication through CI_JOB_TOKEN.
  • The release also contains further backported fixes, though the provided release notes are truncated before listing them.

Self-managed GitLab administrators should upgrade to 19.1.2, 19.0.4, or 18.11.7 according to their supported release line, prioritizing the update because of the two high-severity script-injection vulnerabilities.