CVE-2026-0595
High · 7.3CVSS
7.3
EPSS
0.3%
Published
Feb 11, 2026
CISA due date
—
The record
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add unauthorized email addresses to victim accounts through HTML injection in test case titles.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | gitlab-docker-machine-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-docker-machine-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-docker-machine-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-pages-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-rails-ce-18.1 | 0 | 18.1.6-r6 |
| Chainguard | gitlab-rails-ce-18.2 | 0 | 18.2.8-r3 |
| Chainguard | gitlab-rails-ce-18.3 | 0 | 18.3.6-r3 |
| Chainguard | gitlab-rails-ce-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-assets-18.1 | 0 | 18.1.6-r6 |
| Chainguard | gitlab-rails-ce-assets-18.2 | 0 | 18.2.8-r3 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 0 | 18.3.6-r3 |
| Chainguard | gitlab-rails-ce-assets-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-assets-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | 0 | 18.1.6-r5 |
| Chainguard | gitlab-rails-ce-assets-fips-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-rails-ce-assets-fips-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-assets-fips-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.6 | 0 | 18.6.6-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.7 | 0 | 18.7.4-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-rails-ce-doc-18.1 | 0 | 18.1.6-r6 |
| Chainguard | gitlab-rails-ce-doc-18.2 | 0 | 18.2.8-r3 |
| Chainguard | gitlab-rails-ce-doc-18.3 | 0 | 18.3.6-r3 |
| Chainguard | gitlab-rails-ce-doc-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-doc-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.1 | 0 | 18.1.6-r5 |
| Chainguard | gitlab-rails-ce-doc-fips-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-doc-fips-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-rails-ce-doc-fips-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-doc-fips-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.6 | 0 | 18.6.6-r0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.7 | 0 | 18.7.4-r0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 0 | 18.1.6-r5 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-rails-ce-fips-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 0 | 18.6.6-r0 |
| Chainguard | gitlab-rails-ce-fips-18.7 | 0 | 18.7.4-r0 |
| Chainguard | gitlab-rails-ce-fips-18.8 | 0 | 18.8.4-r0 |
| Chainguard | gitlab-runner-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-runner-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-helper-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-runner-helper-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-helper-compat-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-runner-helper-compat-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-helper-compat-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-helper-compat-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-helper-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-helper-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-runner-oci-entrypoint-18.7 | 0 | 18.7.2-r3 |
| Chainguard | gitlab-runner-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.7 | 0 | 18.7.2-r4 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.8 | 0 | 18.8.0-r2 |
| Chainguard | gitlab-workhorse-ce-18.1 | 0 | 18.1.6-r3 |
| Chainguard | gitlab-workhorse-ce-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-workhorse-ce-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-workhorse-ce-18.4 | 0 | 18.4.6-r0 |
| Chainguard | gitlab-workhorse-ce-18.5 | 0 | 18.5.5-r1 |
| Chainguard | gitlab-workhorse-ce-fips-18.1 | 0 | 18.1.6-r4 |
| Chainguard | gitlab-workhorse-ce-fips-18.2 | 0 | 18.2.8-r3 |
| Chainguard | gitlab-workhorse-ce-fips-18.3 | 0 | 18.3.6-r3 |
| Chainguard | gitlab-workhorse-ce-fips-18.4 | 0 | 18.4.6-r0 |
| Chainguard | gitlab-workhorse-ce-fips-18.5 | 0 | 18.5.5-r0 |
| Wolfi | gitlab-docker-machine-18.7 | 0 | 18.7.2-r3 |
| Wolfi | gitlab-runner-18.7 | 0 | 18.7.2-r3 |
| Wolfi | gitlab-runner-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-helper-18.7 | 0 | 18.7.2-r3 |
| Wolfi | gitlab-runner-helper-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-helper-compat-18.7 | 0 | 18.7.2-r3 |
| Wolfi | gitlab-runner-helper-compat-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-helper-oci-entrypoint-18.7 | 0 | 18.7.2-r3 |
| Wolfi | gitlab-runner-helper-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
| Wolfi | gitlab-runner-oci-entrypoint-18.7 | 0 | 18.7.2-r3 |
| Wolfi | gitlab-runner-oci-entrypoint-18.8 | 0 | 18.8.0-r1 |
Related vulnerabilities
- CVE-2026-1182 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before… Also affects gitlab-docker-machine-18.7
- CVE-2026-1282 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before… Also affects gitlab-docker-machine-18.7
- CVE-2026-1456 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before… Also affects gitlab-docker-machine-18.7
- CVE-2026-1458 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before… Also affects gitlab-docker-machine-18.7
- CVE-2026-1094 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before… Also affects gitlab-docker-machine-fips-18.8
- CVE-2025-3950 Exposure of Private Personal Information to an Unauthorized Actor in GitLab Also affects gitlab-rails-ce-18.1
- CVE-2025-10569 Allocation of Resources Without Limits or Throttling in GitLab Also affects gitlab-rails-ce-18.1
- CVE-2025-11246 Insufficient Granularity of Access Control in GitLab Also affects gitlab-rails-ce-18.1