Improper HTML Sanitization in GitLab Affecting User Account Security
CVE-2026-2995

7.7HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
25 March 2026

What is CVE-2026-2995?

A vulnerability has been identified in GitLab EE that affects a range of versions. This issue stems from improper sanitization of HTML content, which could allow an authenticated user to add their own email addresses to targeted user accounts. This flaw could compromise the integrity of user account details and poses a risk to the security of the affected GitLab installations. Organizations using these versions should ensure they update to the latest patched releases to mitigate potential exploitation.

Affected Version(s)

GitLab 15.4 < 18.8.7

GitLab 18.9 < 18.9.3

GitLab 18.10 < 18.10.1

References

https://hackerone.com/reports/3564600
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/591065
https://about.gitlab.com/releases/2026/03/25/patch-releas...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [a_m_a_m](https://hackerone.com/a_m_a_m) for reporting this vulnerability through our HackerOne bug bounty program
.