{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "GitLab Inc. heeft meerdere kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE) in diverse versies, met name in releases van versie 8.3 tot en met 18.11.3.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden betreffen verschillende componenten en functionaliteiten binnen GitLab, waaronder de Jira-integratie, container registry, virtual registry upstreams, merge request approval policies, debugging symbol downloads, analytics dashboards, package management, issue tracking, project- en groepslidmaatschapsbeheer, en API inputvalidatie. \n\nAanvallers kunnen onder meer:\n- Authenticeerde gebruikers kunnen Jira-issues buiten hun projecttoegang bekijken door onvoldoende toegangscontrole.\n- Ongeauthenticeerde gebruikers kunnen zonder CSRF-bescherming ongeautoriseerde Jira-subscripties aanmaken.\n- Ongeauthenticeerde gebruikers kunnen door onvoldoende inputvalidatie een denial-of-service veroorzaken via speciaal opgemaakte verzoeken of uploads.\n- Authenticeerde gebruikers met ontwikkelaarsrechten kunnen beschermde container registry tags verwijderen en package protection regels omzeilen.\n- Authenticeerde gebruikers kunnen merge request goedkeuringsvereisten omzeilen door het verwijderen van approval rules.\n- Ongeautoriseerde toegang tot interne hosts is mogelijk via virtual registry upstreams door onvoldoende validatie.\n- Cross-site scripting (XSS) aanvallen zijn mogelijk door onvoldoende inputsanitatie in analytics dashboards, e-mail notificaties en andere gebruikersinvoervelden.\n- OAuth tokens met read_api scope kunnen misbruikt worden om issues in private projecten aan te maken en te becommentariëren.\n- Authenticeerde gebruikers met Guest-permissies kunnen toegang krijgen tot projectissues die beperkt zouden moeten zijn.\n- Ongeautoriseerde gebruikers kunnen private groepslidmaatschappen enumereren.\n\nDeze kwetsbaarheden zijn aanwezig in meerdere opeenvolgende versies van GitLab CE en EE, wat wijst op terugkerende problemen in toegangscontrole, inputvalidatie en autorisatie binnen het platform.", "title": "Interpretaties" }, { "category": "description", "text": "GitLab Inc. heeft updates en patches uitgebracht voor de genoemde versies om de diverse kwetsbaarheden te verhelpen. Gebruikers wordt geadviseerd de meest recente updates te installeren om de beveiliging van hun GitLab-omgevingen te waarborgen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "general", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "general", "text": "Authentication Bypass Using an Alternate Path or Channel", "title": "CWE-288" }, { "category": "general", "text": "Cross-Site Request Forgery (CSRF)", "title": "CWE-352" }, { "category": "general", "text": "Unintended Proxy or Intermediary ('Confused Deputy')", "title": "CWE-441" }, { "category": "general", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "general", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Business Logic Errors", "title": "CWE-840" }, { "category": "general", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "general", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "general", "text": "Access Control Check Implemented After Asset is Accessed", "title": "CWE-1280" }, { "category": "general", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-3-released/" } ], "title": "Kwetsbaarheden verholpen in GitLab door GitLab Inc.", "tracking": { "current_release_date": "2026-05-15T09:27:01.154820Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0161", "initial_release_date": "2026-05-15T09:27:01.154820Z", "revision_history": [ { "date": "2026-05-15T09:27:01.154820Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Community Edition, Enterprise Edition" } ], "category": "vendor", "name": "GitLab" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-3160", "cwe": { "id": "CWE-441", "name": "Unintended Proxy or Intermediary ('Confused Deputy')" }, "notes": [ { "category": "other", "text": "Unintended Proxy or Intermediary ('Confused Deputy')", "title": "CWE-441" }, { "category": "description", "text": "GitLab versions 13.7 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 contained a vulnerability allowing authenticated users to view Jira issues outside their project scope due to insufficient enforcement of access restrictions in an integration filter.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-3160 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-3160.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-3160" }, { "cve": "CVE-2026-4527", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "notes": [ { "category": "other", "text": "Cross-Site Request Forgery (CSRF)", "title": "CWE-352" }, { "category": "description", "text": "GitLab addressed a security vulnerability affecting versions 11.10 through 18.11.3 that allowed unauthenticated users to create unauthorized Jira subscriptions due to a missing CSRF protection flaw.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-4527 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4527.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-4527" }, { "cve": "CVE-2026-1659", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "GitLab addressed a denial of service vulnerability affecting GitLab CE/EE versions 9.0 through 18.11.3, exploitable by unauthenticated users via specially crafted requests due to insufficient input validation.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-1659 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-1659.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-1659" }, { "cve": "CVE-2026-1338", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "GitLab addressed a security flaw in versions prior to 18.9.7, 18.10.6, and 18.11.3 where authenticated users with developer permissions could delete protected container registry tags due to improper authorization checks.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-1338 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-1338.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-1338" }, { "cve": "CVE-2026-7471", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "description", "text": "GitLab addressed a security vulnerability in specific GitLab EE versions where authenticated users with control over a virtual registry upstream could send unauthorized requests to internal hosts due to improper validation.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-7471 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-7471.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 3.5, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-7471" }, { "cve": "CVE-2026-6883", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "GitLab fixed a vulnerability in multiple Enterprise Edition versions that allowed authenticated users to bypass merge request approval requirements due to improper cleanup of orphaned policy records.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-6883 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6883.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseScore": 2.6, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-6883" }, { "cve": "CVE-2026-3074", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "GitLab addressed a security flaw in versions 16.7 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 that allowed unauthenticated users to download private debugging symbols from restricted projects due to improper access control.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-3074 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-3074.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-3074" }, { "cve": "CVE-2026-7377", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "GitLab EE versions contained a security flaw allowing authenticated users to execute arbitrary JavaScript in other users' browsers via customizable analytics dashboards due to improper input sanitization.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-7377 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-7377.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-7377" }, { "cve": "CVE-2026-8280", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "GitLab versions 8.3 through before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 contained a vulnerability allowing authenticated users to cause denial of service via excessive memory use due to improper input validation.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-8280 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-8280.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-8280" }, { "cve": "CVE-2026-4524", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "notes": [ { "category": "other", "text": "Authentication Bypass Using an Alternate Path or Channel", "title": "CWE-288" }, { "category": "description", "text": "GitLab versions 18.9.1 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 contained a security flaw allowing authenticated users to access confidential issue content in public projects due to improper authorization checks.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-4524 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4524.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-4524" }, { "cve": "CVE-2026-8144", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "GitLab addressed a security vulnerability in versions 15.1 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 that allowed authenticated project members to enumerate private group members due to missing authorization checks.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-8144 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-8144.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-8144" }, { "cve": "CVE-2026-1184", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "description", "text": "GitLab addressed a denial of service vulnerability in certain GitLab EE versions caused by improper validation of specially crafted file uploads allowing unauthenticated users to disrupt service.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-1184 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-1184.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-1184" }, { "cve": "CVE-2026-1322", "notes": [ { "category": "description", "text": "GitLab addressed a security vulnerability in versions 16.0 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 that allowed authenticated users with read_api scoped OAuth tokens to improperly create and comment on issues in private projects.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-1322 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-1322.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-1322" }, { "cve": "CVE-2026-7481", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "GitLab addressed a security flaw in multiple GitLab EE versions that allowed authenticated developers to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-7481 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-7481.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-7481" }, { "cve": "CVE-2026-6335", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "GitLab versions 18.11 to before 18.11.3 contained a vulnerability allowing authenticated users to execute arbitrary code in other users' browser sessions due to improper input sanitization.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-6335 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6335.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-6335" }, { "cve": "CVE-2026-3073", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "GitLab addressed a security flaw in versions 17.6 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 that allowed authenticated developers to bypass PyPI package restrictions due to improper authorization checks.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-3073 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-3073.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-3073" }, { "cve": "CVE-2025-12669", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code ('Code Injection')", "title": "CWE-94" }, { "category": "description", "text": "GitLab addressed a vulnerability in multiple versions that allowed authenticated users to inject HTML and JavaScript into email notifications due to improper input sanitization.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2025-12669 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-12669.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2025-12669" }, { "cve": "CVE-2026-6073", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "title": "CWE-79" }, { "category": "description", "text": "GitLab addressed a security flaw in specific GitLab EE versions where authenticated users could execute arbitrary JavaScript in other users' browsers due to insufficient input sanitization.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-6073 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6073.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-6073" }, { "cve": "CVE-2026-2900", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "GitLab fixed a security vulnerability in GitLab EE versions before 18.9.7, 18.10.6, and 18.11.3 where Maintainers could bypass instance-level approval rule editing restrictions due to missing authorization checks.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-2900 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2900.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "baseScore": 2.7, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-2900" }, { "cve": "CVE-2026-6063", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "GitLab addressed a security vulnerability in specific versions where authenticated users with developer permissions could bypass access controls to remove code owner approval rules from merge requests.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-6063 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6063.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-6063" }, { "cve": "CVE-2025-13874", "cwe": { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key" }, "notes": [ { "category": "other", "text": "Authorization Bypass Through User-Controlled Key", "title": "CWE-639" }, { "category": "description", "text": "GitLab addressed a security vulnerability in versions 15.1 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 that permitted authenticated users with Guest permissions to access unauthorized project issues.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2025-13874 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-13874.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2025-13874" }, { "cve": "CVE-2026-3607", "cwe": { "id": "CWE-1280", "name": "Access Control Check Implemented After Asset is Accessed" }, "notes": [ { "category": "other", "text": "Access Control Check Implemented After Asset is Accessed", "title": "CWE-1280" }, { "category": "description", "text": "GitLab addressed a security vulnerability in versions 18.3 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3 that allowed authenticated users with developer roles to bypass package protection rules due to improper access control.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-3607 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-3607.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-3607" }, { "cve": "CVE-2025-14870", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "GitLab addressed a denial of service vulnerability caused by insufficient input validation in versions 18.5 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3, exploitable via crafted JSON payloads by unauthenticated users.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2025-14870 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-14870.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2025-14870" }, { "cve": "CVE-2025-14869", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "other", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "description", "text": "GitLab addressed a denial of service vulnerability affecting versions 18.5 to before 18.9.7, 18.10 to before 18.10.6, and 18.11 to before 18.11.3, exploitable via specially crafted API payloads by unauthenticated users.", "title": "Summary" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2025-14869 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-14869.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2025-14869" }, { "cve": "CVE-2026-5297", "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-5297 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-5297.json" } ], "title": "CVE-2026-5297" } ] }