Multiple high vulnerabilities in GitLab CC/EE

Description

CVE-2026-6552: A remote, authenticated threat actor without any user interaction can exploit this vulnerability in the Group SAML identity management functionality to take over another group member’s account. CVE-2026-10087: A network based, authenticated threat actor with developer-role permissions can exploit this vulnerability in the Analytics Dashboard to execute arbitrary code. The attacker can only achieve that if they manage to make the user interact with a malicious payload, which can then use the user’s browser to run client-side code. CVE-2026-7250: A remote, unauthenticated threat actor without any user interaction can exploit this vulnerability in the Grape API JSON parsing middleware to cause system disruption and eventually system crash and denial-of-service. CVE-2026-8589: A