# GitLab GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6

- Product: GitLab (https://whatsnew.fyi/product/gitlab)
- Vendor: GitLab
- Date: 2026-06-24
- Original notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/2026-06-24-gitlab-patch-release-19.1.1-19.0.3-18.11.6

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

On June 24, 2026, we released versions 19.1.1, 19.0.3, 18.11.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly r…

- **security** — Remediated Cross-site Scripting issue in Analytics Dashboard that could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in another user's session
- **security** — Remediated Cross-site Scripting issue in Web IDE workbench asset handler that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session
- **security** — Remediated Information Disclosure issue in Duo Workflows that could have allowed a user to access sensitive information due to insufficient output filtering
- **security** — Remediated Authorization Bypass issue in Virtual Registry Cleanup Policy API that could have allowed an authenticated user to read or modify another group's virtual registry cleanup policy settings without authorization
- **security** — Remediated improper Authorization issue in Rapid Diffs that could have allowed an unauthenticated user to view confidential issue references on public projects
- **security** — Remediated Incorrect Authorization issue in DAST scanner and site profile management
- **security** — Remediated Insufficient Filtering issue in CI/CD API
- **security** — Remediated Improper Input Validation issue in Snippets
- **security** — Remediated Incorrect Authorization issue in Maven Package Registry
- **security** — Remediated Improper Access Control issue in group packages API
- **security** — Remediated Improper Access Control issue in Protected Environments API
- **security** — Remediated Missing Authorization issue in Security Dashboard
- **security** — Remediated Server-Side Request Forgery issue in Repository Mirroring

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6
On June 24, 2026, we released versions 19.1.1, 19.0.3, 18.11.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.
GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.
For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.
We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.
###### Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.
##### Security fixes
###### Table of security fixes
TitleSeverity
Cross-site Scripting issue in Analytics Dashboard impacts GitLab EEHigh
Cross-site Scripting issue in Web IDE workbench asset handler impacts GitLab CE/EEHigh
Information Disclosure issue in Duo Workflows impacts GitLab EEHigh
Authorization Bypass issue in Virtual Registry Cleanup Policy API impacts GitLab EEMedium
Improper Authorization issue in Rapid Diffs impacts GitLab CE/EEMedium
Incorrect Authorization issue in DAST scanner and site profile management impacts GitLab EEMedium
Insufficient Filtering issue in CI/CD API impacts GitLab CE/EEMedium
Improper Input Validation issue in Snippets impacts GitLab CE/EEMedium
Incorrect Authorization issue in Maven Package Registry impacts GitLab CE/EEMedium
Improper Access Control issue in group packages API impacts GitLab CE/EEMedium
Improper Access Control issue in Protected Environments API impacts GitLab EELow
Missing Authorization issue in Security Dashboard impacts GitLab EELow
Server-Side Request Forgery issue in Repository Mirroring impacts GitLab CE/EELow
###### CVE-2026-10086 - Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE
GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user’s session, due to improper sanitization of user-supplied input.
Impacted Versions: GitLab EE: all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)
Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program
###### CVE-2026-10712 - Cross-site Scripting issue in Web IDE workbench asset handler impacts GitLab CE/EE
GitLab has remediated an issue that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user’s browser session due to improper path validation under certain conditions.
Impacted Versions: GitLab CE/EE: all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)
Thanks joaxcar for reporting this

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/]_