CVE-2026-15216

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting in GitLab CE/EE Analytics Dashboard

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-15216

EUVD

EUVD-2026-57437

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 19.1.0 (inc) to 19.1.4 (exc)
gitlab	gitlab	From 19.2.0 (inc) to 19.2.2 (exc)
gitlab	gitlab	From 19.2.0 (inc) to 19.2.2 (exc)
gitlab	gitlab	From 18.2.0 (inc) to 19.0.6 (exc)
gitlab	gitlab	From 19.1.0 (inc) to 19.1.4 (exc)
gitlab	gitlab	From 18.2.0 (inc) to 19.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in GitLab CE/EE affecting versions before 19.0.6, 19.1.4, and 19.2.2. It occurs due to improper neutralization of user-controlled data in pagination controls by an analytics dashboard component, allowing malicious scripts to execute in a user's browser.

Detection Guidance

This vulnerability is specific to GitLab versions before 19.0.6, 19.1.4, and 19.2.2 and involves cross-site scripting in pagination controls. To detect it, check your GitLab version with commands like 'gitlab-rake gitlab:env:info' or 'cat /opt/gitlab/version-manifest.txt'. If your version is below the patched releases, the system is vulnerable.

Impact Analysis

An attacker could exploit this to steal session cookies, perform actions on behalf of the user, or redirect users to malicious sites. It requires user interaction, such as clicking a crafted link, and the attacker must have at least developer role permissions.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing sensitive user information. Organizations must patch to maintain compliance.

Mitigation Strategies

Upgrade GitLab CE/EE to versions 19.0.6, 19.1.4, or 19.2.2 or later to remediate the cross-site scripting vulnerability in pagination controls.

Hi! I’m here to help you understand CVE-2026-15216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70