GitLab CE/EE CVE-2026-15216

Exploitation requires an authenticated GitLab account with at minimum low privileges (PR:L confirmed by CVSS vector) - this corresponds to any role that can view analytics dashboards, typically Reporter-level or above on a project. The victim must view the analytics dashboard page containing the attacker-controlled pagination data (UI:R); passive browsing or administrator review of project analytics satisfies this. No special non-default configuration is described as required - the analytics dashboard is a standard GitLab feature. Exploitation is limited by the requirement for victim interaction (UI:R) and the attacker needing at least one low-privilege account on the target instance; unauthenticated external attackers cannot exploit this directly. The attack does not require any specific platform, OS, or non-default module.

The CVSS 8.7 score is well-supported by the vector metrics: AV:N/AC:L/PR:L confirms network-reachable exploitation requiring only a low-privilege account, which in GitLab deployments often means any registered user or project member. UI:R is the primary friction point - a victim must view the manipulated analytics dashboard page. The Changed Scope (S:C) with C:H/I:H reflects the severe session-hijacking potential, particularly if a GitLab administrator is lured to the page. No EPSS score was provided in the intelligence, so probabilistic exploitation rate cannot be quantified, but the existence of a public PoC on HackerOne (report 3830061) materially increases the likelihood of opportunistic exploitation in the near term. This vulnerability is not currently listed in the CISA KEV catalog, meaning active exploitation has not been confirmed at time of analysis, but the low barrier - any authenticated user - means even a mid-sized IT operation should treat this as urgent patching priority given the potential for privilege escalation through session theft. The broad version range (all releases from 18.2 onward in three supported trains) implies a large vulnerable population on self-managed GitLab instances.

An attacker with a low-privilege GitLab account (e.g., a Reporter or Developer role on any project) crafts a payload that injects malicious JavaScript into a field consumed by the analytics dashboard's pagination controls. The attacker then shares a link to the affected analytics view, or waits for a targeted high-privilege user (such as a GitLab administrator) to naturally navigate to the page. When the victim loads the page, the injected script executes in their browser context, enabling session token theft, unauthorized API calls, or account takeover. A public proof-of-concept is available via HackerOne report 3830061, which lowers the skill threshold for exploitation.