EUVD-2026-36226
GHSA-q9j8-24p8-jq8j
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-reachable web UI (AV:N), low complexity (AC:L), requires an authenticated account able to edit group settings (PR:L), needs victim interaction (UI:R); payload executes in victim browser context yielding scope change and account takeover (S:C, C:H/I:H, A:N).
Primary rating from Vendor (GitLab).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
7DescriptionNVD
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.
Articles & Coverage 2
AnalysisAI
Stored cross-site scripting and account integrity abuse in GitLab Enterprise Edition versions 13.1.4 through 18.10.7, 18.11 prior to 18.11.5, and 19.0 prior to 19.0.2 allows an authenticated low-privileged user to inject unsanitized input into certain group setting fields and add unauthorized email addresses to a targeted user's account. Publicly available exploit code exists via a HackerOne report, though EPSS exploitation probability remains very low at 0.02% and the SSVC framework rates current exploitation as 'none' with total technical impact when successful.
Technical ContextAI
GitLab EE is the commercial distribution of the GitLab DevOps platform used for source code management, CI/CD, and team collaboration. The flaw is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in how certain group setting fields handle user-supplied input - sanitization is insufficient, allowing an attacker-controlled string to be processed in a way that ultimately causes an unauthorized email address to be attached to a victim's account. Because email addresses are commonly used for password reset and account verification flows, this primitive crosses from a typical XSS into account-takeover territory. The affected CPE is cpe:2.3:a:gitlab:gitlab covering the listed branches.
RemediationAI
Vendor-released patch: upgrade GitLab EE to 19.0.2, 18.11.5, or 18.10.8 (or later) depending on your release train, as announced in the GitLab patch release blog at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. Until patching is possible, restrict who can edit group settings by removing Maintainer/Owner privileges from untrusted users and review group settings fields for unexpected HTML or script-like payloads; administrators can also temporarily disable self-service email address additions in user profile settings to break the account-takeover primitive, accepting the trade-off that legitimate users will need admin help to update email addresses. Monitor the audit log for unexpected email additions and group-setting changes during the exposure window and follow up by reviewing the HackerOne disclosure at https://hackerone.com/reports/3722842 to understand the exact payload class to detect.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today