CVE-2026-1230: Use of Incorrectly-Resolved Name or Reference in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause repository downloads to contain different code than displayed in the web interface due to incorrect validation of branch references under certain circumstances.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to cause repository downloads to contain different code than displayed in the web interface due to incorrect validation of branch references under certain circumstances.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-1230?
CVE-2026-1230 has a moderate severity level due to the potential for an authenticated user to download incorrect repository code.
How do I fix CVE-2026-1230?
To fix CVE-2026-1230, upgrade to GitLab versions 18.7.6, 18.8.6, or 18.9.2 or later.
What types of users are affected by CVE-2026-1230?
Authenticated users of GitLab CE/EE prior to the patched versions are affected by CVE-2026-1230.
What are the impacted versions for CVE-2026-1230?
CVE-2026-1230 affects GitLab versions from 1.0 up to, but not including, 18.7.6, 18.8.6, and 18.9.2.
Can CVE-2026-1230 lead to security breaches?
Yes, CVE-2026-1230 can potentially lead to security issues if users download repositories containing altered code.