GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenti…
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- IT leaders should verify if any self-managed GitLab installations are running affected versions and apply the latest updates immediately.
- Ensure all GitLab CE and EE systems are upgraded to versions 19.3.1, 19.2.5, or 19.1.7 to address the security remediation.
Questions to ask IT
- Do we run GitLab, and which versions?
- Is any of it reachable from the internet?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2025-10903- 6.5 · MediumExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on availability.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Not listed
- ~0.4% estimated chance of attack in 30 days
- 11.10 before 19.1.7, 19.2 before 19.2.5, 19.3 before 19.3.1
- 19.1.7, 19.2.5, 19.3.1
These facts are for CVE-2025-10903. This event covers 2 more CVEs, each with its own record. Versions are as the CVE record states them; check the vendor advisory before planning a fix.
- Versions 19.3.1, 19.2.5, and 19.1.7 address the issue in GitLab EE affecting specific version ranges.
- The remediation applies to GitLab EE installations running versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- GitLab has addressed a security issue in GitLab EE impacting versions from 11.10 up to but not including 19.1.7, 19.2 up to but not including 19.2.5, and 19.3 up to but not including 19.3.1.
- New versions 19.3.1, 19.2.5, and 19.1.7 were released on 26 August 2026, containing security fixes for GitLab CE and EE.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- GitLab93% match confidence · CVE-2025-10903
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 18:20 UK time
- Story3 Nov 2026, 18:20 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenti…
- ProbableSummary fact75% confidence
On 26 August 2026, we released versions 19.3.1, 19.2.5, 19.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2025-10903
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-18252
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-77801