PT-2026-7524

CVE-2026-0595

Published

2026-02-11

Updated

2026-02-16

Description by

CVSS 3.1

7.3

High

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.9 through 18.6.6 GitLab CE/EE versions 18.7 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4

Description An issue exists in GitLab CE/EE where an authenticated user could potentially add unauthorized email addresses to victim accounts. This is possible due to HTML injection within test case titles under specific conditions.

Recommendations Update GitLab CE/EE to a version after 18.6.6. Update GitLab CE/EE to a version after 18.7.4. Update GitLab CE/EE to a version after 18.8.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Joaxcar

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-0595