wid-sec-w-2026-0697 · Published 2026-03-11 · View on BSI CERT-Bund ↗

GitLab: Multiple Vulnerabilities

CVSS 8.7 HIGH

Risk Summary

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain conditions.

CVEs (14)

CVE-2025-12555 CVE-2025-12576 CVE-2025-12697 CVE-2025-12704 CVE-2025-13690 CVE-2025-13929 CVE-2025-14513 CVE-2026-0602 CVE-2026-1069 CVE-2026-1090 CVE-2026-1230 CVE-2026-1663 CVE-2026-1732 CVE-2026-3848

Affected Vendors

Open Source

Affected Products (6)

Open Source · GitLab <18.9.2

Open Source · GitLab 18.9.2

Open Source · GitLab <18.8.6

Open Source · GitLab 18.8.6

Open Source · GitLab <18.7.6

Open Source · GitLab 18.7.6

Get alerted to advisories like this

OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.

Start free trial Learn more