CVE-2026-78252
Last modified
CVE-2026-78252 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 15.3.0, < 19.1.8 |
| Gitlab | Gitlab | >= 19.2.0, < 19.2.6 |
| Gitlab | Gitlab | >= 19.3.0, < 19.3.2 |
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/621447Issue Tracking
- https://hackerone.com/reports/3917471Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-78252?
How severe is CVE-2026-78252?
How do I fix CVE-2026-78252?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-78246A vulnerability has been found in itsourcecode Online Clinic…7.3
- CVE-2026-78247A vulnerability was found in SourceCodester Simple Online Fo…7.3
- CVE-2026-78248A vulnerability was determined in SourceCodester Simple Onli…7.3
- CVE-2026-78249A path traversal vulnerability exists in the web management …6.8
- CVE-2026-78250A vulnerability was identified in bytebot-ai bytebot 0.0.1. …4.3
- CVE-2026-78251DJI drones contain an FTP service that uses hardcoded creden…9.3
- CVE-2026-78253Uncontrolled recursion in QXmlStreamReader::readElementText(…2.3
- CVE-2026-78254The ftp and scp tasks of Apache Ant can download files from …7.4
- CVE-2026-78255The HTTP media server running on DJI drones serves stored ph…8.7
- CVE-2026-78257Contributor PHP Object Injection in Booking and Rental Manag…8.8
- CVE-2026-78258Unauthenticated Broken Access Control in Booking and Rental …5.3
- CVE-2026-78259Unauthenticated Broken Authentication in WPLegalPages <= 3.7…7.3
Are you affected by CVE-2026-78252?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST