CVE-2026-78252

MediumCVSS 6.1/10Last modified Sep 28, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-782532.3Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application cras CVE-2026-782547.4The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to CVE-2026-782558.7The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting CVE-2026-782578.8Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782585.3Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782597.3Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.CVE-2026-78269.1A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 CVE-2026-782609.3Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.CVE-2026-782617.1Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.CVE-2026-782629.8Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.CVE-2026-782637.1Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.CVE-2026-782647.1Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.