CVE-2026-6896

Published Jul 8, 2026

Last updated 7 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-6896 describes a vulnerability in GitLab Enterprise Edition (EE) stemming from improper sanitization of user-supplied input. This flaw could allow an authenticated user with developer-role permissions to execute arbitrary scripts within another user's browser session under specific conditions. The issue impacts various versions of GitLab EE, specifically all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2. GitLab has released remediations for this vulnerability.

Description: GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.
Source: cve@gitlab.com
NVD status: Analyzed
Products: gitlab

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

cve@gitlab.com: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "32643EA5-8C1A-418A-A6B5-EDCADEC8C79E",
            "versionEndExcluding": "18.11.7",
            "versionStartIncluding": "13.11.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "77F37C9F-5A51-4AD0-A919-F74CA49F8048",
            "versionEndExcluding": "19.0.4",
            "versionStartIncluding": "19.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "71AC7E45-C1B7-4EFE-8C29-E1D7ADD3D9F4",
            "versionEndExcluding": "19.1.2",
            "versionStartIncluding": "19.1.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.