CVE-2026-1094 MEDIUM

CVE-2026-1094: Improper Validation of Unsafe Equivalence in Input in GitLab

Vendor Gitlab

Product GitLab

Weakness CWE-1289

Published February 11, 2026

Last update February 11, 2026

View on NVD All CVEs

CVSS base score

4.6/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.

Key dates

02Disclosure timeline

February 11, 2026 CVE published

February 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1094 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1289.html

Related vulnerabilities

CVE-2026-1094: Improper Validation of Unsafe Equivalence in Input in GitLab

01Description

02Disclosure timeline

03References

04Related CVE