CVE-2026-112212

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 18.3, < 19.3.6; >= 19.4, < 19.4.3; >= 19.5, < 19.5.1

References

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/work_items/627499Permissions Required

Timeline

Published: Oct 22, 2026
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1122146.5A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is CVE-2026-1122185.3Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Secur CVE-2026-1122194.9The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve f CVE-2026-112226.5Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafte CVE-2026-1122217.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart all CVE-2026-1122225.4Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-112236.5Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised CVE-2026-1122303.7The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routin CVE-2026-1122376.9The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does n CVE-2026-1122388.7The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters o CVE-2026-1122397.2The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks CVE-2026-112248.1Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malici