GitLab Enterprise Edition contains a cross‑site scripting flaw that, when exploited by an authenticated user, permits insertion of malicious input into certain group setting fields. The vulnerability can be used to add unauthorized email addresses to a target user’s account, effectively granting the attacker an additional means to impersonate or conduct phishing attacks. The flaw is a classic example of CWE‑79, where improper neutralization of input during web page generation leads to unauthorized data manipulation.

All GitLab EE releases from 13.1.4 up to, but not including, 18.10.8; from 18.11.0 up to, but not including, 18.11.5; and from 19.0.0 up to, but not including, 19.0.2 are vulnerable. The fix is available in 18.10.8, 18.11.5, and 19.0.2 or newer.

The CVSS score of 7.3 indicates a high severity vulnerability, and the lack of an EPSS score means there is no current exploit prevalence data. The flaw can be leveraged by an authenticated user; it does not require remote code execution and is not listed in the CISA KEV catalog. Due to the requirement of authentication, typical attack scenarios would involve a compromised or privileged account within the same GitLab instance, which can then inject malicious group setting data to add arbitrary email addresses to another user.