CVE-2026-7377
HighSummary
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. In customizable analytics dashboards, an authenticated user could have executed arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.
Risk Assessment
The risk is that an authenticated user could exploit this vulnerability to perform XSS attacks, potentially leading to data theft or session hijacking of other users.
Recommendation
It is recommended to update GitLab EE to the latest version to mitigate this vulnerability and to conduct a security review of the application.
Other vulnerabilities in GitLab EE
See all- CVE-2026-4868High
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Under certain conditions, an authenticated user could have caused specific Duo AI workflows to run under another user's identity due to improper user identity resolution.
- CVE-2026-7481High
GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
- CVE-2026-6073High
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.
- CVE-2026-7487Low
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.
- CVE-2026-18252High
GitLab EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 have a vulnerability that allows an authenticated user with developer role to execute arbitrary commands in a CI context. This occurs through the Claude agent processing configuration from a user-controlled source.
- CVE-2025-10903Medium
GitLab EE contains a DoS vulnerability in the SCIM user provisioning feature. An authenticated user can send specially crafted input causing an unbounded loop, leading to denial of service.
- CVE-2026-6821Medium
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.
- CVE-2026-4879Medium
GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.
- CVE-2026-19228High
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.
- CVE-2026-18433Medium
In GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2, under certain conditions an authenticated user could read policy configuration belonging to a namespace they were not authorized to access due to incorrect authorization checks in a GraphQL query.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.