PT-2026-34518 · Gitlab · Gitlab Ce/Ee

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-5262

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.1.0 through 18.9.5 GitLab CE/EE versions 18.10 through 18.10.3 GitLab CE/EE versions 18.11 through 18.11.0

Description Improper input validation under certain conditions could allow an unauthenticated user to access tokens in the Storybook development environment.

Recommendations Update to version 18.9.6 Update to version 18.10.4 Update to version 18.11.1

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5262

Affected Products

Gitlab Ce/Ee

References · 5

• 🔥 https://hackerone.com/reports/3574642 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5262 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/595332 · Note
• https://twitter.com/CVEnew/status/2047012124309045706 · Twitter Post
• https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released · Note