Executive brief
GitLab is a platform used by software teams to manage code and automate development. A security issue was found where a user with developer permissions could manipulate file names to hide specific code changes during the review process. This could allow malicious code to be merged into a project without being noticed by reviewers, potentially compromising the integrity of the software.
Technical details
An authorization bypass vulnerability (CWE-639) exists in GitLab CE/EE due to improper input handling of file names. An authenticated attacker with at least 'Developer' role permissions can craft specific file names that, under certain conditions, cause the merge request diff view to fail to display certain changes. This allows an attacker to bypass manual code review by hiding malicious modifications from the reviewer's interface. The attack requires network access and some user interaction (the reviewer viewing the diff). The issue is resolved in versions 18.10.8, 18.11.5, and 19.0.2.
Affected products
- GitLab GitLab Community Edition (CE) 15.9 to <18.10.8, 18.11 to <18.11.5, 19.0 to <19.0.2
- GitLab GitLab Enterprise Edition (EE) 15.9 to <18.10.8, 18.11 to <18.11.5, 19.0 to <19.0.2
Timeline
- 2026-06-10: patched: GitLab released versions 18.10.8, 18.11.5, and 19.0.2 to address the issue.
- 2026-06-11: disclosed: Public disclosure of CVE-2026-6976.