Vulnerabilities

CVSS

3.3 Low

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Risk score

26.4

Published

2026-08-12

Status

Published

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

Weaknesses

CWE-266

Coverage 1

vulnerability

Multiples vulnérabilités dans GitLab (13 août 2026)

Multiple vulnerabilities have been discovered in GitLab, including remote code injection, denial of service, and privilege escalation. These issues affect versions 19.1.x through 19.1.4, 19.2.x through 19.2.2, and all ve…

CERT-FR · Aug 13, 2026 High

CVE-2025-9486CVE-2026-15216CVE-2026-15217gitlabvulnerabilityremote code injection

All articles mentioning it

Advisories and references

• gitlab.com/gitlab-org/gitlab/-/issues/565412
• hackerone.com/reports/3262844
• docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-release...