Improper URL Validation in GitLab CE/EE
CVE-2026-12635
NONE
What is CVE-2026-12635?
An issue exists in GitLab CE and EE affecting various versions where improper URL validation could enable authenticated users with maintainer permissions to make unauthorized requests to internal network resources through mirror synchronization. This vulnerability highlights the importance of proper input validation and access controls to safeguard sensitive network components.
Affected Version(s)
GitLab 8.3 < 18.11.6
GitLab 19.0 < 19.0.3
GitLab 19.1 < 19.1.1
References
CVSS V3.1
Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This vulnerability has been discovered internally by GitLab team member FĂ©lix Veillette-Potvin