Gitlab CVE-2026-2995

GitLab Enterprise Edition versions 15.4-18.8.6, 18.9.0-18.9.2, 18.10.0. Requires authenticated user account. Victim must click attacker-crafted link exploiting improper HTML sanitization in email address addition functionality.

The CVSS score of 7.7 (High) reflects the serious nature of this vulnerability, though the AC:H (high attack complexity) and UI:R (user interaction required) factors provide some mitigation against mass exploitation. The vulnerability requires an authenticated attacker with low privileges (PR:L) to craft malicious content that a victim must interact with, limiting automated exploitation. However, the changed scope (S:C) and high confidentiality and integrity impacts (C:H/I:H) indicate successful exploitation could lead to account compromise. The public availability of a proof-of-concept on HackerOne significantly elevates risk, as threat actors can reproduce the attack. For organizations running affected GitLab EE versions, this represents a genuine priority requiring prompt patching, particularly for internet-facing instances with external users. The email address manipulation capability could enable sophisticated social engineering attacks, account takeover preparation, or privilege escalation chains.

An authenticated attacker with a low-privileged GitLab account crafts a malicious comment, issue description, or merge request containing specially formatted HTML that exploits the sanitization flaw. When a victim user with higher privileges views this content and interacts with it, the XSS payload executes in their browser context, allowing the attacker to silently add their own controlled email address to the victim's account profile. With access established via the added email, the attacker can then initiate password reset flows or receive sensitive notifications, ultimately leading to full account takeover of privileged GitLab users.