# GitLab GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6

- Product: GitLab (https://whatsnew.fyi/product/gitlab)
- Vendor: GitLab
- Date: 2026-08-12
- Original notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/2026-08-12-gitlab-patch-release-19.2.2-19.1.4-19.0.6

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

On August 12, 2026, we released versions 19.2.2, 19.1.4, 19.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly…

- **security** — Fix cross-site scripting issue in Analytics Dashboards table field configuration that could allow improper neutralization of user-controlled values rendered in table cell content
- **security** — Fix cross-site scripting issue in Analytics Dashboards pagination controls that could allow improper neutralization of user-controlled data rendered in pagination controls
- **security** — Fix remote code execution via path traversal vulnerability in package registry that could allow authenticated users to achieve code execution
- **security** — Fix improper authorization issue in CI/CD pipeline API that could allow developers to execute pipelines on protected branches without required push permissions
- **security** — Fix authorization bypass issue in Duo Workflow Service that could allow authenticated users to cause AI usage attribution to another namespace
- **security** — Fix cross-site scripting issue in CI manual job confirmation modal
- **security** — Fix missing authorization issue in ProjectsController in GitLab EE
- **security** — Fix denial of service issue in GraphQL API JSON parser
- **security** — Fix missing authorization issue in merge requests API in GitLab EE
- **security** — Fix missing authorization issue in external status check API in GitLab EE
- **security** — Fix incorrect authorization issue in npm dist-tags endpoint
- **security** — Fix missing authorization issue in GitLab Duo settings page in GitLab EE
- **security** — Fix incorrect authorization issue in AI Tool Rules GraphQL resolver in GitLab EE
- **security** — Fix incorrect privilege assignment issue in custom roles in GitLab EE

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6
On August 12, 2026, we released versions 19.2.2, 19.1.4, 19.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.
GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.
For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.
We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.
###### Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.
##### Security fixes
###### Table of security fixes
TitleSeverity
Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EEHigh
Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EEHigh
Remote code execution via path traversal in package registry impacts GitLab CE/EEHigh
Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EEHigh
Authorization Bypass issue in Duo Workflow Service impacts GitLab EEHigh
Cross-site Scripting issue in CI manual job confirmation modal impacts GitLab CE/EEHigh
Missing Authorization issue in ProjectsController impacts GitLab EEHigh
Denial of Service issue in GraphQL API JSON parser impacts GitLab CE/EEMedium
Missing Authorization issue in merge requests API impacts GitLab EEMedium
Missing Authorization issue in external status check API impacts GitLab EEMedium
Incorrect Authorization issue in npm dist-tags endpoint impacts GitLab CE/EEMedium
Missing Authorization issue in GitLab Duo settings page impacts GitLab EEMedium
Incorrect Authorization issue in AI Tool Rules GraphQL resolver impacts GitLab EEMedium
Incorrect Privilege Assignment issue in custom roles impacts GitLab EELow
###### CVE-2026-15217 - Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE
GitLab has remediated an issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.
Impacted Versions: GitLab CE/EE: all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)
Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program
###### CVE-2026-15216 - Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE
GitLab has remediated an issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.
Impacted Versions: GitLab CE/EE: all versions fr

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/]_