Code Validation Flaw in GitLab CE/EE by GitLab
CVE-2026-1230

4.1MEDIUM

Key Information:

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 11 March 2026

What is CVE-2026-1230?

GitLab has addressed a significant code validation flaw in GitLab CE/EE that permitted authenticated users to download repositories containing altered code compared to what was shown in the web interface. This issue arose from improper validation of branch references in specific circumstances, potentially allowing for misleading code to be presented to users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

GitLab 1.0 < 18.7.6

GitLab 18.8 < 18.8.6

GitLab 18.9 < 18.9.2

References

https://hackerone.com/reports/3505165

technical-descriptionexploitpermissions-required

https://gitlab.com/gitlab-org/gitlab/-/work_items/587002

https://about.gitlab.com/releases/2026/03/11/patch-releas...

CVSS V3.1

Score:

4.1

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Mar 11, 2026
Vulnerability Reserved
Jan 20, 2026

Credit

Thanks [st4nly0n](https://hackerone.com/st4nly0n) for reporting this vulnerability through our HackerOne bug bounty program

JSON

Gitlab