CVE-2026-12635
UnknownCVSS 0.0Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in GitLab CE/EE allows an authenticated user with maintainer role to make requests to internal network resources via mirror synchronization due to improper URL validation. Affected versions: from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.
Risk Assessment
An attacker with maintainer role could exploit this to scan or attack internal network resources, potentially leading to data leakage or privilege escalation.
Recommendation
Update GitLab to version 18.11.6, 19.0.3, or 19.1.1 immediately. As a workaround, restrict maintainer permissions to trusted users.
Original NVD description (English source)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through mirror synchronization due to improper URL validation.