PT-2026-27992 · Gitlab · Gitlab Ce/Ee

Published 2026-03-25 · Updated 2026-03-27 · CVE-2026-2995

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 15.4 through 18.8.6 GitLab EE versions 18.9 through 18.9.2 GitLab EE versions 18.10 through 18.10.0

Description An authenticated user could add email addresses to targeted user accounts due to improper sanitization of HTML content.

Recommendations Update GitLab EE to version 18.8.7 or later. Update GitLab EE to version 18.9.3 or later. Update GitLab EE to version 18.10.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2026-06379

BIT-GITLAB-2026-2995

CVE-2026-2995

Affected Products

Gitlab Ce/Ee

References · 8

• 🔥 https://hackerone.com/reports/3564600 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2995 · Security Note
• https://bdu.fstec.ru/vul/2026-06379 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-2995 · Vendor Advisory
• https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released · Vendor Advisory
• https://twitter.com/CVEnew/status/2036911842224902265 · Twitter Post
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-10-1-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/work_items/591065 · Note