PT-2026-90500 · Undefined · Undefined
CVE-2026-88765
·
Published
2026-09-11
·
Updated
2026-09-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
GitLab released security patches 19.3.2, 19.2.6, and 19.1.8 addressing vulnerabilities across Community Edition and Enterprise Edition.
-
The most severe flaws include unauthenticated arbitrary file disclosure (CVE-2026-85706), authenticated credential and configuration exposure through GraphQL deserialization (CVE-2026-87719), and authenticated remote code execution through crafted project imports (CVE-2026-88765).
-
Additional issues affect CI/CD variable access, protected-environment approvals, authentication controls, package integrity, cross-site scripting, authorization, and denial-of-service resilience.
-
Self-managed installations running affected versions should be upgraded promptly; single-node deployments may experience downtime because of database migrations, while multi-node deployments can use zero-downtime procedures.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined