The issue in GitLab Enterprise Edition allows an authenticated user to add email addresses to targeted accounts because HTML content is not properly sanitized. This flaw can be leveraged to inject malicious scripts that execute in the victim’s browser, potentially enabling cookie theft, session hijacking, or defacement. The vulnerability is a classic example of improper neutralization of script‑related HTML tags and qualifies as a basic XSS attack.

GitLab Enterprise edition users are impacted. The vulnerability exists in all GitLab EE releases from version 15.4 up through 18.7, including 18.8.6, 18.9.2, and 18.10.0. Any instance running these versions of GitLab before the fixed releases of 18.8.7, 18.9.3, or 18.10.1 is susceptible.

The CVSS score of 7.7 indicates high severity, while the EPSS probability is below 1 percent, implying the likelihood of observed exploitation is low. It is not listed in the CISA KEV catalog. Attack requires authenticated access and use of the email‑addition functionality, which is commonly available to registered users, so the attack vector is likely authenticated XSS. Given the high impact and the availability of an official patch, the risk to affected deployments is significant if the vulnerability remains unpatched.