CVE-2026-0595

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add unauthorized email addresses to victim accounts through HTML injection in test case titles.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 13.9, < 18.6.6; >= 18.7, < 18.7.4; >= 18.8, < 18.8.4

References

https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/584975Broken Link, Issue Tracking
https://hackerone.com/reports/3486862Permissions Required

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-05967.8A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded dire CVE-2026-05979.8A flaw has been found in Campcodes Supplier Management System 1.0. Affected by this issue is some unknown functionality of the file /retaile CVE-2026-05984.2A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not proper CVE-2026-05997.5A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external CVE-2026-06006.2Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators CVE-2026-06015.1A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaS CVE-2026-06024.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 th CVE-2026-06038.3A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing s CVE-2026-06046.5The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and inclu CVE-2026-06059.8A security vulnerability has been detected in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionalit CVE-2026-06069.8A vulnerability was detected in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Front CVE-2026-06079.8A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminViewSongs.php