CVE-2026-1101

MediumCVSS 6.5/10Last modified Jul 25, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

No affected versions have been published.

Timeline

Published
Apr 8, 2026
Last modified
Jul 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-110108.3Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proCVE-2026-1101005.4Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days CVE-2026-1101015.4Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as DatumCVE-2026-1101027.5Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verifCVE-2026-1101035.4bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoCVE-2026-1101045.9Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserCVE-2026-1101055.3B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes becaCVE-2026-1101064.2RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other userCVE-2026-1101074.2RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other usCVE-2026-1101088.1MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by callinCVE-2026-1101096.5JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codCVE-2026-110118.1Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th
CVE-2026-1101: Medium severity, CVSS 6.5 | Vulnix