GitLab Patches an Auto-Linking Account Takeover and a Poisoned Discovery Map. Both Trusted Input Nobody Checked.
Photo: Pixabay (illustration)
GitLab shipped a critical patch release on October 21, 2026, fixing 12 security vulnerabilities across its Community and Enterprise editions. It covers versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, detailed on the patch release page . Two identity bugs lead the advisory: CVE-2026-15723 and CVE-2026-112212. Both trusted input nobody checked. Identity linking and cache poisoning CVE-2026-15723 is high severity, CVSS 8.2, and affects GitLab CE and EE from 10.1 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.
Source: Forkast
