HTML injection in GitLab EE group setting fields allowing unauthorized email addition

Successful exploitation can compromise account integrity by associating attacker-controlled or otherwise unauthorized email addresses with another user's GitLab account. This may expose sensitive account-related information to the attacker and enable unauthorized account-related actions that rely on email address ownership or notification flows. Published scoring indicates high confidentiality and integrity impact, no direct availability impact, changed scope, and required user interaction.

If immediate upgrade is not possible, reduce exposure by limiting access to authenticated users who can modify the affected group setting fields, closely monitoring changes to user email addresses and group settings, and reviewing audit logs for suspicious modifications. Because the flaw depends on improper sanitization and user interaction, restricting who can supply or alter content in the affected fields may reduce risk until patching is completed. GitLab.com was already patched, and GitLab Dedicated customers reportedly did not need to take action.

Upgrade GitLab EE to a fixed release. GitLab remediated the issue in 18.10.8, 18.11.5, and 19.0.2. Self-managed installations running affected versions should upgrade to the appropriate patched version or later. GitLab also noted that the patch release includes database migrations that may cause downtime on single-node deployments unless zero-downtime upgrade procedures are used in multi-node environments.