What is the CVSS score of CVE-2026-7481?

CVE-2026-7481 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of GitLab EE are affected by CVE-2026-7481?

GitLab Enterprise Edition versions 16.4 through 18.11.x prior to patched releases contain a stored cross-site scripting vulnerability exploitable by users with Developer-role permissions.. A patch is available.

How to fix or mitigate CVE-2026-7481?

Within 24 hours: Inventory all GitLab Enterprise Edition deployments and identify instances running versions 16.4-18.11.x; document current versions and count users with Developer-role permissions. Within 7 days: Apply vendor-released patches (18.9.7 for 18.9.x series, 18.10.6 for 18.10.x series, 18.11.3 for 18.11.x series). Within 30 days: Audit all project activities and code contributions since deployment for suspicious commits; review authentication logs for unusual privileged user sessions; implement mandatory peer code review for all contributions.

GitLab EE CVE-2026-7481

EUVD-2026-30240 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 cve@gitlab.com

GHSA-4qfp-7g23-rwjx

XSS Gitlab

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:58 vuln.today

Patch available

May 14, 2026 - 07:16 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

AnalysisAI

Stored cross-site scripting in GitLab Enterprise Edition lets an authenticated user holding Developer-role permissions inject arbitrary JavaScript that executes in the browsers of other users who view the affected content. The flaw stems from improper input sanitization and affects all 16.4-series through 18.11.x releases prior to the 18.9.7, 18.10.6, and 18.11.3 patch releases. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but CVSS is rated 8.7 because the scope-changing XSS can hijack higher-privileged user sessions.

Technical ContextAI

The underlying weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic cross-site scripting condition where user-supplied content is rendered in the GitLab web UI without adequate output encoding or sanitization. Because GitLab EE renders rich content (issues, MRs, comments, wiki, snippets) inside the same origin that hosts session cookies and CSRF tokens, injected script runs with the full privileges of the viewing user. The CPE strings confirm the issue is scoped to the Enterprise edition product (cpe:2.3:a:gitlab:gitlab:*:enterprise) rather than Community Edition, suggesting the vulnerable rendering path lives in an EE-only feature.

RemediationAI

Upgrade to the vendor-released patched versions 18.11.3, 18.10.6, or 18.9.7 depending on the release train in use, as documented at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. Self-managed administrators should follow GitLab's standard zero-downtime upgrade path and verify the patched version via the /help endpoint after deployment; gitlab.com is already patched by GitLab Inc. As a compensating control while patching is scheduled, tighten project membership so that Developer role is granted only to trusted users, audit recent additions of Developer-role members for suspicious accounts, and consider enabling a strict Content Security Policy via gitlab.rb (gitlab_rails['content_security_policy']) to limit inline script execution - note that custom CSPs can break some GitLab integrations and Pages previews and should be tested in staging first. The HackerOne report is tracked at https://hackerone.com/reports/3697379 for additional disclosure context.