CVE-2026-8589

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-858917.5Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a CVE-2026-858927.8Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an aut CVE-2026-858938.8Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.CVE-2026-85908.7Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Serv CVE-2026-859008.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-859017.8Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.CVE-2026-859027.8Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally.CVE-2026-859038.8Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.CVE-2026-859047.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an CVE-2026-859058.8Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.CVE-2026-859067.8Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.CVE-2026-859087.8Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.