What is the CVSS score of CVE-2026-4332?

CVE-2026-4332 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4332?

Yes, a patch is available for CVE-2026-4332. Update the affected software to the latest version immediately.

Gitlab CVE-2026-4332

EUVD-2026-20800 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 cve@gitlab.com

GHSA-26q6-hm4f-j23h

XSS Gitlab

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

18.8.9,18.10.3,18.9.5

EUVD ID Assigned

Apr 08, 2026 - 23:24 euvd

EUVD-2026-20800

Analysis Generated

Apr 08, 2026 - 23:24 vuln.today

CVE Published

Apr 08, 2026 - 23:16 nvd

MEDIUM 5.4

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

AnalysisAI

Stored cross-site scripting (XSS) in GitLab EE customizable analytics dashboards allows authenticated users to execute arbitrary JavaScript in other users' browsers due to improper input sanitization. Affected versions include 18.2-18.8.8, 18.9-18.9.4, and 18.10-18.10.2. An attacker with valid GitLab credentials can craft malicious dashboard configurations that execute when other users view the dashboard, potentially stealing session tokens, modifying visible data, or performing actions on behalf of the victim. No public exploit code or active exploitation in the wild has been confirmed; patches are available.

Technical ContextAI

The vulnerability is a stored cross-site scripting (CWE-79) flaw in GitLab EE's customizable analytics dashboard feature. The underlying issue stems from insufficient input sanitization when processing user-supplied data for dashboard configurations. Unlike reflected XSS, stored XSS persists in the application's database and executes whenever any user accesses the affected dashboard, making it a high-impact vector for lateral privilege escalation or mass compromise within a GitLab instance. The analytics dashboard likely uses JavaScript templating or dynamic HTML generation to render user-customized content, but fails to properly escape or sanitize JavaScript context data before rendering it to other users' browsers.

RemediationAI

Upgrade GitLab EE to version 18.8.9 or later, 18.9.5 or later, or 18.10.3 or later, depending on your deployed branch. Vendor-released patch is confirmed in the 18.10.3 release (and corresponding releases for 18.8 and 18.9 branches). Until upgrade is possible, restrict access to customizable analytics dashboards to trusted users only via GitLab's role-based access control, and audit existing dashboards for suspicious configurations. Refer to the official GitLab patch release at https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/ for upgrade instructions.