A critical security flaw in GitLab EE allows authenticated attackers to manipulate user account email settings, posing a significant risk to account integrity.

This vulnerability is caused by improper neutralization of script-related HTML tags (CWE-80), which allows an authenticated user to inject malicious content and modify account data. The attack requires the user to be authenticated and involves user interaction to trigger the improper sanitization flaw.

The ability for an attacker to add email addresses to arbitrary user accounts facilitates account takeover, unauthorized access to sensitive repositories, and potential lateral movement within the development environment. With a CVSS score of 7.7, this vulnerability represents a high risk to the confidentiality and integrity of the GitLab platform, necessitating swift remediation to prevent unauthorized privilege escalation or data exposure.

Immediate Action: Upgrade GitLab EE installations to version 18.8.7, 18.9.3, 18.10.1, or any subsequent release provided by the vendor.

Proactive Monitoring: Monitor user account activity logs for suspicious email address additions or unauthorized profile modifications.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and ensure that web application firewalls are configured to filter malicious HTML input patterns.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced HackerOne report.

Given the potential for account takeover and the availability of technical details regarding the exploit, administrators must prioritize patching this vulnerability immediately. Organizations should verify their current GitLab EE version and apply the recommended updates to ensure the sanitization mechanisms are correctly enforced.