Authenticated User Email Addition in GitLab EE

Executive Summary

This vulnerability in GitLab EE affects versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. It allows an authenticated user, under certain conditions, to add unauthorized email addresses to another user's account. This happens due to improper sanitization of user-supplied input in certain group setting fields.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized modification of user accounts by allowing attackers to add email addresses they do not own to other users' accounts. This could result in unauthorized access to notifications, password resets, or other sensitive communications intended for the targeted user, potentially compromising account security and privacy.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab EE to a fixed version. Specifically, update to version 18.10.8 or later if you are using the 18.10 series, 18.11.5 or later if using the 18.11 series, or 19.0.2 or later if using the 19.0 series.

This vulnerability affects versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2, and it allows an authenticated user to add unauthorized email addresses to another user's account due to improper sanitization of user input in certain group setting fields.

Useful 0 Not Useful 0