PT-2026-24714 · Gitlab · Gitlab Ce/Ee

St4Nly0N · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-1230

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 18.7.6 GitLab CE/EE versions 18.8 prior to 18.8.6 GitLab CE/EE versions 18.9 prior to 18.9.2

Description An authenticated user could potentially cause repository downloads to contain different code than displayed in the web interface. This is due to incorrect validation of branch references under specific conditions.

Recommendations Update GitLab CE/EE to version 18.7.6 or later. Update GitLab CE/EE to version 18.8.6 or later. Update GitLab CE/EE to version 18.9.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-706

Related Identifiers

BDU:2026-03437

BIT-GITLAB-2026-1230

CVE-2026-1230

Affected Products

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1230.json · Exploit
• 🔥 https://hackerone.com/reports/3505165 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1230 · Security Note
• https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1230 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1230 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03437 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-1230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1230 · Vendor Advisory
• https://twitter.com/CVEnew/status/2032998320218493028 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1230 · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/587002 · Note