CVE-2026-2995 describes a cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) that allowed an authenticated user to add email addresses to targeted user accounts due to improper HTML sanitization. This impacts GitLab EE versions 15.4 through 18.8.6, 18.9 through 18.9.2, and 18.10 through 18.10.0. With a CVSS score of 5.4 (Medium), the vulnerability requires low privileges and user interaction, and could lead to low impacts on confidentiality and integrity, primarily facilitating social engineering or phishing attacks. There is no evidence of active exploitation, nor are public exploit modules or proof-of-concept code currently available. Community discussion is minimal, and its very low EPSS score suggests a low probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 18.10, < 18.10.1CPE match | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | ||
>= 15.4, < 18.8.7CPE match | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | ||
>= 18.9, < 18.9.3CPE match | cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* | ||
>= 15.4.0, < 18.8.7CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* | ||
>= 18.9.0, < 18.9.3CPE matchmatch criteria | cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.