CVE-2026-6896 | GitLab has remediated an issue in GitLab EE affecting all ve… | CVSS 8.7 HIGH

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

Metadata

CVE ID: CVE-2026-6896
State: PUBLISHED
Assigner: GitLab
Reserved: 2026-04-23 05:33 UTC
Published: 2026-07-08 20:46 UTC
Last updated: 2026-07-09 14:13 UTC
Primary CWE: CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product: GitLab / GitLab
Sources: cve.org · NVD

Severity & Metrics

8.7 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
GitLab	GitLab	—	13.11 < 18.11.7, 19.0 < 19.0.4, 19.1 < 19.1.2

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.7	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References (3)

https://gitlab.com/gitlab-org/gitlab/-/work_items/597887
HackerOne Bug Bounty Report #3682085 https://hackerone.com/reports/3682085
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/