What is the CVSS score of CVE-2026-2995?

CVE-2026-2995 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-2995?

Yes, a public proof-of-concept exploit is available for CVE-2026-2995. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2995?

Within 24 hours: Identify all GitLab EE instances running versions 15.4-18.10.1 and document current deployment versions. Within 7 days: Apply the available vendor patch to all affected GitLab EE instances; verify patch deployment across the environment. Within 30 days: Conduct access reviews to identify any unauthorized email address additions to critical accounts and audit user modification permission scopes.

Gitlab CVE-2026-2995

Q: Which versions of Gitlab are affected by CVE-2026-2995?

GitLab EE versions 15.4 through 18.10.1 contain an HTML sanitization flaw that allows authenticated users to add email addresses to arbitrary accounts, creating a direct path to account takeover and…. A patch is available.

EUVD-2026-15811 HIGH

Basic XSS (CWE-80)

2026-03-25 GitLab

GHSA-3qcv-5pqj-c2h7

Gitlab XSS

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:14 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

18.8.7,18.10.1,18.9.3

PoC Detected

Mar 26, 2026 - 17:42 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15811

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:33 nvd

HIGH 7.7

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

AnalysisAI

Improper HTML sanitization in GitLab EE versions 15.4-18.10.1 allows authenticated users to add email addresses to arbitrary user accounts, potentially enabling account takeover or unauthorized access escalation. Public exploit code exists for this vulnerability, and no patch is currently available. Affected deployments should implement access controls to restrict user modification privileges until updates become available.

Technical ContextAI

This vulnerability affects GitLab Enterprise Edition (CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*) and is rooted in CWE-80, which describes improper neutralization of script-related HTML tags in web pages. The flaw stems from insufficient sanitization of HTML content within GitLab's email management functionality, allowing specially crafted payloads to bypass input validation. When executed in the context of another user's session, the XSS vulnerability enables an attacker to perform privileged actions such as adding email addresses to victim accounts, potentially facilitating account takeover scenarios. The cross-site scope (S:C in CVSS vector) indicates the vulnerability can affect resources beyond the vulnerable component's security scope.

RemediationAI

Upgrade GitLab Enterprise Edition immediately to version 18.8.7 or later for the 18.8 series, version 18.9.3 or later for the 18.9 series, or version 18.10.1 or later for the 18.10 series as documented in the patch release at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/. Organizations unable to patch immediately should implement compensating controls including strict Content Security Policy headers to mitigate XSS risks, restrict user registration to trusted domains, enable two-factor authentication for all accounts to prevent account takeover even if email addresses are manipulated, and monitor audit logs for suspicious email address modifications. Review existing user email addresses for unauthorized additions and implement additional input validation at the web application firewall level to filter XSS patterns until patching is complete.