NCSC-2026-0447

Vulnerability from csaf_ncscnl - Published: 2026-10-22 09:12 - Updated: 2026-10-22 09:12
Summary
Kwetsbaarheden verholpen in GitLab door GitLab Inc.
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: GitLab heeft 12 kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE). Eén kwetsbaarheid is als kritiek aangemerkt. GitLab heeft een kwetsbaarheid verholpen in GitLab Community Edition en Enterprise Edition binnen de versies vanaf 7.0 tot bepaalde 19.x releases.
Interpretaties: De kwetsbaarheid met kenmerk CVE-2026-110264 heeft een CVSS-score van 10,0 en betreft een integer overflow bij het compileren van een speciaal vervaardigde reguliere expressie. Onder bepaalde omstandigheden kan een niet-geauthenticeerde kwaadwillende de kwetsbaarheid op afstand misbruiken om willekeurige code op de GitLab-serveruit te voeren. De kwetsbaarheid treft GitLab-versies vanaf 7.0. De kwetsbaarheden met kenmerk CVE-2026-15723 en CVE-2026-112212 zijn als High aangemerkt. CVE-2026-15723 kan door een geauthenticeerd aanvaller bij specifieke SAML- en LDAP-configuraties leiden tot overname van een bestaand account. CVE-2026-112212 betreft cache poisoning in OAuth/OIDC-discovery-endpoints en kan bepaalde authenticatiestromen omleiden naar een door een kwaadwillende beheerde server. De overige kwetsbaarheden kunnen onder meer leiden tot ongeautoriseerde toegang tot informatie en het omzeilen van toegangs- en beveiligingscontroles. GitLab heeft twee detectieregels gepubliceerd waarmee beheerders van self-managed GitLab-installaties kunnen zoeken naar mogelijke exploitatiepogingen van CVE-2026-110264. GitLab meldt vooralsnog geen actief misbruik van de kwetsbaarheid.
Oplossingen: GitLab adviseert alle getroffen self-managed installaties zo snel mogelijk te upgraden naar een gepatchte versie. De kwetsbaarheden zijn verholpen in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 en 19.5.1. GitLab.com is reeds bijgewerkt. GitLab Dedicated-installaties met versie 19.3.5-internal0, 19.4.2-internal0 of later bevatten de beveiligingsupdates al. Voor CVE-2026-110264 adviseert GitLab beheerders van self-managed installaties daarnaast de detectieregels “Onigmo native worker crash” en “Org mode render error burst” te gebruiken om te controleren op mogelijke exploitatiepogingen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-190: Integer Overflow or Wraparound
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-201: Insertion of Sensitive Information Into Sent Data
CWE-348: Use of Less Trusted Source
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2026-12664

GitLab versions prior to 19.3.6, 19.4.3, and 19.5.1 contained a vulnerability allowing authenticated users with read_api-scoped tokens to bypass token restrictions and access project incoming email addresses via a GraphQL field with insufficient scope enforcement.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-863 - Incorrect Authorization
Affected products
Product Identifier Version Remediation
vers:unknown/*
GitLab / GitLab
 vers:unknown/*
CVE-2026-13319

GitLab addressed a security vulnerability in certain GitLab CE/EE versions where authenticated users could access milestone metadata from private projects without proper authorization due to missing checks in the group milestones API.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-639 - Authorization Bypass Through User-Controlled Key
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-14288

GitLab addressed a security flaw in GitLab EE versions 17.4 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to bypass merge request approval policies on protected branches due to improper access control during approval rule synchronization.

3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-706 - Use of Incorrectly-Resolved Name or Reference
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-15723

GitLab addressed a security flaw in multiple versions where an authenticated user could hijack LDAP-backed accounts via improper input sanitization in LDAP email lookup during OmniAuth SAML and LDAP auto-linking.

8.2 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-16255

GitLab addressed a security flaw in GitLab EE versions prior to 19.3.6, 19.4.3, and 19.5.1 that allowed users to bypass instance-wide SAML or LDAP membership locks, enabling unauthorized project and group memberships outside identity provider controls.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE-863 - Incorrect Authorization
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-103515

GitLab addressed a security vulnerability in GitLab EE versions where group Owners could circumvent admin locks to reactivate AI-driven data egress to third-party services against administrator restrictions.

2.7 (Low)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE-863 - Incorrect Authorization
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-105711

GitLab addressed a security flaw in versions 15.0 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where authenticated users without project membership could view confidential issue titles from private projects via public merge requests due to improper caching.

3.5 (Low)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE-524 - Use of Cache Containing Sensitive Information
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-105777

GitLab addressed a vulnerability in versions 17.6.5 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where unauthenticated users could access sensitive internal server credentials due to improper filtering of internal response headers.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-201 - Insertion of Sensitive Information Into Sent Data
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-110264

A vulnerability in GitLab CE/EE versions 7.0 through certain 19.x releases allows unauthenticated users to execute arbitrary code via an integer overflow triggered by a crafted regular expression.

10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-112212

GitLab versions 18.3 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 contained a vulnerability allowing unauthenticated users to manipulate OAuth/OIDC discovery documents via a shared cache, enabling redirection to external servers due to improper validation of cached endpoint URLs.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-112326

GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users with read-only access to permanently delete existing vulnerability records due to improper error handling.

3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-460 - Improper Cleanup on Thrown Exception
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
CVE-2026-112378

GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to access paid AI features without valid subscription due to insufficient server-side billing validation.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-348 - Use of Less Trusted Source
Affected products
Known affected 1 product, the same list as for CVE-2026-12664
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "GitLab heeft 12 kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE). E\u00e9n kwetsbaarheid is als kritiek aangemerkt.\n\n\nGitLab heeft een kwetsbaarheid verholpen in GitLab Community Edition en Enterprise Edition binnen de versies vanaf 7.0 tot bepaalde 19.x releases.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid met kenmerk CVE-2026-110264 heeft een CVSS-score van 10,0 en betreft een integer overflow bij het compileren van een speciaal vervaardigde reguliere expressie. Onder bepaalde omstandigheden kan een niet-geauthenticeerde kwaadwillende de kwetsbaarheid op afstand misbruiken  om willekeurige code op de GitLab-serveruit te voeren. De kwetsbaarheid treft GitLab-versies vanaf 7.0.\n\nDe kwetsbaarheden met kenmerk CVE-2026-15723 en CVE-2026-112212 zijn als High aangemerkt. CVE-2026-15723 kan door een geauthenticeerd aanvaller bij specifieke SAML- en LDAP-configuraties leiden tot overname van een bestaand account. CVE-2026-112212 betreft cache poisoning in OAuth/OIDC-discovery-endpoints en kan bepaalde authenticatiestromen omleiden naar een door een kwaadwillende beheerde server. De overige kwetsbaarheden kunnen onder meer leiden tot ongeautoriseerde toegang tot informatie en het omzeilen van toegangs- en beveiligingscontroles.\n\nGitLab heeft twee detectieregels gepubliceerd waarmee beheerders van self-managed GitLab-installaties kunnen zoeken naar mogelijke exploitatiepogingen van CVE-2026-110264. GitLab meldt vooralsnog geen actief misbruik van de kwetsbaarheid.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "GitLab adviseert alle getroffen self-managed installaties zo snel mogelijk te upgraden naar een gepatchte versie. De kwetsbaarheden zijn verholpen in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 en 19.5.1. GitLab.com is reeds bijgewerkt. GitLab Dedicated-installaties met versie 19.3.5-internal0, 19.4.2-internal0 of later bevatten de beveiligingsupdates al.\n\nVoor CVE-2026-110264 adviseert GitLab beheerders van self-managed installaties daarnaast de detectieregels \u201cOnigmo native worker crash\u201d en \u201cOrg mode render error burst\u201d te gebruiken om te controleren op mogelijke exploitatiepogingen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
        "title": "CWE-90"
      },
      {
        "category": "general",
        "text": "Insertion of Sensitive Information Into Sent Data",
        "title": "CWE-201"
      },
      {
        "category": "general",
        "text": "Use of Less Trusted Source",
        "title": "CWE-348"
      },
      {
        "category": "general",
        "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
        "title": "CWE-444"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"
      }
    ],
    "title": "Kwetsbaarheden verholpen in GitLab door GitLab Inc.",
    "tracking": {
      "current_release_date": "2026-10-22T09:12:12.147880Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0447",
      "initial_release_date": "2026-10-22T09:12:12.147880Z",
      "revision_history": [
        {
          "date": "2026-10-22T09:12:12.147880Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "GitLab"
          }
        ],
        "category": "vendor",
        "name": "GitLab"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12664",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "GitLab versions prior to 19.3.6, 19.4.3, and 19.5.1 contained a vulnerability allowing authenticated users with read_api-scoped tokens to bypass token restrictions and access project incoming email addresses via a GraphQL field with insufficient scope enforcement.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-12664 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12664.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-12664"
    },
    {
      "cve": "CVE-2026-13319",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authorization Bypass Through User-Controlled Key",
          "title": "CWE-639"
        },
        {
          "category": "description",
          "text": "GitLab addressed a security vulnerability in certain GitLab CE/EE versions where authenticated users could access milestone metadata from private projects without proper authorization due to missing checks in the group milestones API.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-13319 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13319.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-13319"
    },
    {
      "cve": "CVE-2026-14288",
      "cwe": {
        "id": "CWE-706",
        "name": "Use of Incorrectly-Resolved Name or Reference"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Incorrectly-Resolved Name or Reference",
          "title": "CWE-706"
        },
        {
          "category": "description",
          "text": "GitLab addressed a security flaw in GitLab EE versions 17.4 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to bypass merge request approval policies on protected branches due to improper access control during approval rule synchronization.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-14288 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14288.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-14288"
    },
    {
      "cve": "CVE-2026-15723",
      "cwe": {
        "id": "CWE-90",
        "name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
          "title": "CWE-90"
        },
        {
          "category": "description",
          "text": "GitLab addressed a security flaw in multiple versions where an authenticated user could hijack LDAP-backed accounts via improper input sanitization in LDAP email lookup during OmniAuth SAML and LDAP auto-linking.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15723 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15723.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-15723"
    },
    {
      "cve": "CVE-2026-16255",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "GitLab addressed a security flaw in GitLab EE versions prior to 19.3.6, 19.4.3, and 19.5.1 that allowed users to bypass instance-wide SAML or LDAP membership locks, enabling unauthorized project and group memberships outside identity provider controls.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-16255 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16255.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-16255"
    },
    {
      "cve": "CVE-2026-103515",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "GitLab addressed a security vulnerability in GitLab EE versions where group Owners could circumvent admin locks to reactivate AI-driven data egress to third-party services against administrator restrictions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-103515 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103515.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-103515"
    },
    {
      "cve": "CVE-2026-105711",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Cache Containing Sensitive Information",
          "title": "CWE-524"
        },
        {
          "category": "description",
          "text": "GitLab addressed a security flaw in versions 15.0 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where authenticated users without project membership could view confidential issue titles from private projects via public merge requests due to improper caching.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-105711 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105711.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-105711"
    },
    {
      "cve": "CVE-2026-105777",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insertion of Sensitive Information Into Sent Data",
          "title": "CWE-201"
        },
        {
          "category": "description",
          "text": "GitLab addressed a vulnerability in versions 17.6.5 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 where unauthenticated users could access sensitive internal server credentials due to improper filtering of internal response headers.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-105777 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105777.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-105777"
    },
    {
      "cve": "CVE-2026-110264",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A vulnerability in GitLab CE/EE versions 7.0 through certain 19.x releases allows unauthenticated users to execute arbitrary code via an integer overflow triggered by a crafted regular expression.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-110264 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110264.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-110264"
    },
    {
      "cve": "CVE-2026-112212",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
          "title": "CWE-444"
        },
        {
          "category": "description",
          "text": "GitLab versions 18.3 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 contained a vulnerability allowing unauthenticated users to manipulate OAuth/OIDC discovery documents via a shared cache, enabling redirection to external servers due to improper validation of cached endpoint URLs.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-112212 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112212.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-112212"
    },
    {
      "cve": "CVE-2026-112326",
      "cwe": {
        "id": "CWE-460",
        "name": "Improper Cleanup on Thrown Exception"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Cleanup on Thrown Exception",
          "title": "CWE-460"
        },
        {
          "category": "description",
          "text": "GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users with read-only access to permanently delete existing vulnerability records due to improper error handling.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-112326 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112326.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-112326"
    },
    {
      "cve": "CVE-2026-112378",
      "cwe": {
        "id": "CWE-348",
        "name": "Use of Less Trusted Source"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Less Trusted Source",
          "title": "CWE-348"
        },
        {
          "category": "description",
          "text": "GitLab addressed a vulnerability in GitLab EE versions 17.8 to before 19.3.6, 19.4 to before 19.4.3, and 19.5 to before 19.5.1 that allowed authenticated users to access paid AI features without valid subscription due to insufficient server-side billing validation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-112378 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112378.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-112378"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.