GitLabCVE-2026-6896

GitLab: cross-site scripting

CVE-2026-6896 · Published Jul 8, 2026 · updated Jul 9, 2026

High8.7

Fix: upgrade to 18.11.7 or later (3 fixed versions below)

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 13.11, < 18.11.7	18.11.7
	>= 19.0, < 19.0.4	19.0.4
	>= 19.1, < 19.1.2	19.1.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79

More GitLab advisories

All GitLab

Medium 4.3Jul 8

GitLab: improper authorizationCVE-2026-7492fixed in 18.11.7 +2 Medium 4.3Jul 8

GitLab: missing authorizationCVE-2026-8472fixed in 18.11.7 +2 Low 2.7Jul 8

GitLab: improper authorizationCVE-2026-6352fixed in 18.11.7 +2 Medium 4.9Jul 8

GitLab: improper authorizationCVE-2026-11827fixed in 18.11.7 +2 High 7.3Jul 8

GitLab: cross-site scriptingCVE-2026-13320fixed in 18.11.7 +2 Low 3.5Jul 8

GitLab: authenticated user could create a repositoryCVE-2025-12506fixed in 18.11.7 +2