CVE-2026-9204

GitLab has fixed multiple vulnerabilities in GitLab Community Edition and Enterprise Edition (EE) versions ranging from 12.0 to 19.0.2, including major releases such as 17.x, 18.10.8, 18.11.5, and 19.0.2. The vulnerabilities affect various components of GitLab CE & EE. Authenticated users with developer permissions can execute arbitrary client-side code via the Analytics Dashboard interface due to insufficient sanitization of user input. A denial of service (DoS) can be caused on the CI/CD Catalog page by improper input sanitization, making the page unavailable. A DoS can also occur by uploading specially crafted files that lead to resource exhaustion, which can crash or make the GitLab service unresponsive. Furthermore, authenticated users can gain unauthorized access to confidential issue data due to improper authorization controls. Developer users can modify hidden merge requests due to flawed authorization, and also manipulate merge request diff views by improper handling of file names, which can hide changes during code reviews. Users with the Security Manager role can manage project security settings despite this feature being disabled, due to improper authorization. Within Group SAML identity management, group Owners can take control over other group members due to improper authorization controls. Unauthorized email addresses can be added to accounts via insufficient input sanitization in group settings. During repository import, insufficient validation of secondary URLs can lead to reading arbitrary files on the Gitaly server and access to internal network resources. Finally, an unauthenticated user can impersonate the GitLab Support Bot by injecting arbitrary content into Service Desk email responses, caused by improper handling of email templates.

[![CVE-2026-9204 status](https://www.csirts.com/badge/CVE-2026-9204)](https://www.csirts.com/cve/CVE-2026-9204)