EUVD-2026-36226
GHSA-q9j8-24p8-jq8j
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-reachable web UI (AV:N), low complexity (AC:L), requires an authenticated account able to edit group settings (PR:L), needs victim interaction (UI:R); payload executes in victim browser context yielding scope change and account takeover (S:C, C:H/I:H, A:N).
Primary rating from Vendor (GitLab).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
7DescriptionNVD
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.
Articles & Coverage 2
AnalysisAI
Stored cross-site scripting and account integrity abuse in GitLab Enterprise Edition versions 13.1.4 through 18.10.7, 18.11 prior to 18.11.5, and 19.0 prior to 19.0.2 allows an authenticated low-privileged user to inject unsanitized input into certain group setting fields and add unauthorized email addresses to a targeted user's account. Publicly available exploit code exists via a HackerOne report, though EPSS exploitation probability remains very low at 0.02% and the SSVC framework rates current exploitation as 'none' with total technical impact when successful.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must (1) hold an authenticated GitLab EE account with sufficient privileges to modify the specific vulnerable group setting fields on a group the victim will visit, and (2) induce the targeted user to interact with the poisoned group context (UI:R in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed: CVSS 3.1 base of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects a high-impact, low-complexity network-reachable issue requiring some authentication and victim interaction with scope change, while EPSS is only 0.02% (5th percentile) and SSVC exploitation status is 'none' and automatable is 'no'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged but authenticated GitLab user with permission to edit certain group settings injects a malicious payload into a vulnerable group setting field; when a targeted higher-privileged user interacts with the affected group page, the payload executes in their session and adds an attacker-controlled email address to their account, enabling subsequent password reset and full account takeover. Publicly available exploit code exists via HackerOne report 3722842, lowering the bar for any attacker who already holds a GitLab account on a vulnerable instance. |
| Remediation | Vendor-released patch: upgrade GitLab EE to 19.0.2, 18.11.5, or 18.10.8 (or later) depending on your release train, as announced in the GitLab patch release blog at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all GitLab EE instances and their current versions (affected: 13.1.4-18.10.7, 18.11 prior to 18.11.5, 19.0 prior to 19.0.2). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stored cross-site scripting in GitLab Enterprise Edition's Analytics Dashboard allows an authenticated developer-role us
Account takeover in GitLab Enterprise Edition versions 15.5 through 19.0.2 allows an authenticated group Owner to hijack
Denial of service in GitLab CE/EE versions 12.10 through 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 allows un
Uncontrolled resource consumption in GitLab CE/EE's file upload processing pipeline enables any authenticated user to tr
Incorrect authorization enforcement in GitLab CE/EE exposes hidden merge requests to unauthorized modification by authen
Share
External POC / Exploit Code
Leaving vuln.today