# GitLab GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7

- Product: GitLab (https://whatsnew.fyi/product/gitlab)
- Vendor: GitLab
- Date: 2026-05-13
- Original notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-3-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/2026-05-13-gitlab-patch-release-18.11.3-18.10.6-18.9.7

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

On May 13, 2026, we released versions 18.11.3, 18.10.6, 18.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly r…

- **security** — Fix Cross-site Scripting issue in Analytics dashboard chart rendering that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers
- **security** — Fix Cross-site Scripting issue in global search that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers
- **security** — Fix Cross-site Scripting issue in Duo Agent output rendering that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers
- **security** — Fix Cross-site Scripting issue in Analytics Dashboard that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers
- **security** — Fix Denial of Service issue in CI/CD job update API
- **security** — Fix Denial of Service issue in Duo Workflows API
- **security** — Fix Denial of Service issue in internal API endpoints
- **security** — Fix Improper Authorization issue in GraphQL token scope enforcement
- **security** — Fix Denial of Service issue in Insights Configuration
- **security** — Fix Access Control issue in Issues API
- **security** — Fix Denial of Service issue in direct transfer CSV parser
- **security** — Fix CSRF issue in JiraConnect subscriptions
- **security** — Fix Confused Deputy issue in Jira integration
- **security** — Fix Cross-site Scripting issue in Banzai markdown sanitizer
- **security** — Fix Cross-site Scripting issue in achievement email notifications
- **security** — Fix Access Control issue in Helm package upload
- **security** — Fix Improper Access Control issue in NuGet Symbol Server
- **security** — Fix Improper Access Control issue in Container Registry protected tags
- **security** — Fix Missing Authorization issue in group user search
- **security** — Fix Access Control issue in PyPI Package Protection Rules

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7
On May 13, 2026, we released versions 18.11.3, 18.10.6, 18.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.
GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.
For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.
We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.
###### Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.
##### Security fixes
###### Table of security fixes
TitleSeverity
Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EEHigh
Cross-site Scripting issue in global search impacts GitLab CE/EEHigh
Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EEHigh
Cross-site Scripting issue in Analytics Dashboard impacts GitLab EEHigh
Denial of Service issue in CI/CD job update API impacts GitLab CE/EEHigh
Denial of Service issue in Duo Workflows API impacts GitLab CE/EEHigh
Denial of Service issue in internal API endpoints impacts GitLab CE/EEHigh
Improper Authorization issue in GraphQL token scope enforcement impacts GitLab CE/EEMedium
Denial of Service issue in Insights Configuration impacts GitLab EEMedium
Access Control issue in Issues API impacts GitLab CE/EEMedium
Denial of Service issue in direct transfer CSV parser impacts GitLab CE/EEMedium
CSRF issue in JiraConnect subscriptions impacts GitLab CE/EEMedium
Confused Deputy issue in Jira integration impacts GitLab CE/EEMedium
Cross-site Scripting issue in Banzai markdown sanitizer impacts GitLab CE/EEMedium
Cross-site Scripting issue in achievement email notifications impacts GitLab CE/EEMedium
Access Control issue in Helm package upload impacts GitLab CE/EEMedium
Improper Access Control issue in NuGet Symbol Server impacts GitLab CE/EEMedium
Improper Access Control issue in Container Registry protected tags impacts GitLab CE/EEMedium
Missing Authorization issue in group user search impacts GitLab CE/EEMedium
Improper Access Control issue in code owner approval rules impacts GitLab EEMedium
Access Control issue in PyPI Package Protection Rules impacts GitLab CE/EEMedium
Improper Access Control issue in issue links API impacts GitLab CE/EEMedium
Server-Side Request Forgery issue in virtual registry redirect handler impacts GitLab EELow
Access Control issue in GraphQL approval rule mutations impacts GitLab EELow
Missing Authorization issue in Security Policy Project Reassignment impacts GitLab EELow
###### CVE-2026-7481 - Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE
GitLab has remediated an issue that could have allowed an authenticated user

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-3-released/]_