Executive brief
GitLab Enterprise Edition, a platform used by organizations to manage software development and source code, contains a security vulnerability that allows certain authorized users to run malicious scripts in the browsers of other users. An attacker with 'developer' permissions could use this to steal sensitive session information or perform unauthorized actions on behalf of other employees. GitLab has released security updates to address this issue, and organizations should update their installations to the latest patched versions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in GitLab EE due to improper input sanitization. An authenticated attacker with at least 'developer' role permissions can inject malicious scripts into the application. When other users view the affected content, the script executes within the context of their browser session. This vulnerability is tracked as CWE-79 and has a CVSS score of 8.7, reflecting high impact on confidentiality and integrity due to the potential for session hijacking or unauthorized API actions. The issue is resolved in versions 18.9.7, 18.10.6, and 18.11.3.
Affected products
- GitLab GitLab Enterprise Edition (EE) 16.4 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.9.7, 18.10.6, and 18.11.3 to address the issue.
- 2026-05-14: disclosed: CVE-2026-7481 was published.