GitLab EE HTML Injection Vulnerability in User Accounts

A vulnerability allowing HTML injection has been identified in GitLab Enterprise Edition (EE) versions 15.4 prior to 18.8.7, 18.9 prior to 18.9.3, and 18.10 prior to 18.10.1. This issue could have enabled an authenticated user to add email addresses to targeted user accounts, stemming from inadequate sanitization of HTML content.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of user account information, specifically the addition of email addresses, which could be misused for account recovery or impersonation purposes.

Remediation

Users are advised to upgrade to GitLab EE versions 18.10.1, 18.9.3, or 18.8.7. Instructions for updating GitLab can be found on the GitLab Update page.