GitLab Patches Critical Web IDE Token Theft and DoS Vulnerabilities

Home » News
Yash Shield
News
Reading time icon 2 min. read

Calendar icon Published on

GitLab released security patches for Community Edition (CE) and Enterprise Edition (EE) on February 10, 2026. Versions 18.8.4, 18.7.4, and 18.6.6 fix four high-severity flaws enabling token theft, server crashes, and XSS attacks. Self-managed instances must upgrade immediately.

CVE-2025-7659 (CVSS 8.0) tops the list. It hits the Web IDE with incomplete validation. Unauthenticated attackers steal private repository tokens. This grants full access to source code without logins.

BEST WINTER DEALS
Editor's Choice
Private Internet Access

Access content across the globe at the highest speed rate.

70% of our readers choose Private Internet Access

70% of our readers choose ExpressVPN

ExpressVPN

Browse the web from multiple devices with industry-standard security protocols.
Nord VPN

Faster dedicated servers for specific actions (currently at summer discounts)

Two DoS flaws threaten availability. CVE-2025-8099 (CVSS 7.5) crashes GraphQL via complex queries. CVE-2026-0958 (CVSS 7.5) exhausts resources by bypassing JSON checks.

CVE-2025-14560 (CVSS 7.3) enables XSS in Code Flow. Malicious scripts run in victims’ browsers. Attackers hijack sessions or steal data this way.

GitLab.com received fixes already. Self-hosted admins face brief downtime for migrations. Medium issues like SSRF got patched too.

Vulnerability Details Table

CVE IDSeverityComponentImpact
CVE-2025-76598.0 HighWeb IDEToken theft, repo access
CVE-2025-80997.5 HighGraphQLService crash
CVE-2026-09587.5 HighJSON middlewareResource exhaustion
CVE-2025-145607.3 HighCode FlowXSS session hijack

Attackers need no accounts for CVE-2025-7659. GraphQL abuse requires minimal setup. XSS spreads via shared views.

Patch Requirements

  • Upgrade to 18.8.4, 18.7.4, or 18.6.6 immediately.
  • Test single-node setups for migration downtime.
  • Scan logs for exploit attempts post-upgrade.
  • Review Web IDE access patterns.

Teams running older versions face highest risk. GitLab urges swift action before widespread scans begin.

FAQ

What is CVE-2025-7659?

Web IDE flaw lets unauthenticated users steal private repo tokens. CVSS 8.0.

How do DoS attacks work here?

CVE-2025-8099 floods GraphQL. CVE-2026-0958 bypasses JSON limits for exhaustion.

Does XSS affect GitLab.com?

Patched already. Self-managed needs manual upgrade.

Upgrade downtime expected?

Brief for single-node database migrations. Cluster setups minimal impact.

Where to get patches?

GitLab release notes

Yash

Yash Shield

I am a Business Analytics student with a strong interest in publishing well-researched and data-driven news articles. I focus on analyzing trends in business, finance, and technology to create clear, accurate, and engaging content for readers. I enjoy transforming complex data and information into simple, meaningful stories that help audiences understand current developments. With analytical thinking and attention to detail, I aim to deliver credible and insightful news that adds real value to readers.

Readers help support VPNCentral. We may get a commission if you buy through our links. Tooltip Icon

Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more

User forum

0 messages