Executive brief
GitLab Enterprise Edition, a platform for software development and collaboration, contains a security flaw in its Analytics Dashboard. An attacker with developer-level access could use this vulnerability to run malicious code in another user's browser session. This could lead to the theft of sensitive session information or unauthorized actions being performed on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Analytics Dashboard component of GitLab Enterprise Edition (EE). The flaw is caused by improper sanitization of user-supplied input, which allows an authenticated attacker with at least 'developer' role permissions to inject malicious scripts. When another user views the affected dashboard, the script executes in the context of their session. This can lead to session hijacking, unauthorized data access, or performing actions as the victim user. The issue affects versions 16.4 through 18.11.6, 19.0.x before 19.0.3, and 19.1.x before 19.1.1. GitLab has released patches to address this vulnerability.
Affected products
- GitLab GitLab Enterprise Edition 16.4 to 18.11.6, 19.0 to 19.0.3, 19.1 to 19.1.1
Timeline
- 2026-06-24: patched: GitLab released versions 19.1.1, 19.0.3, and 18.11.6.
- 2026-06-25: disclosed: CVE-2026-10086 published.