CVE-2020-13276

HIGH

GitLab CE/EE <13.0.1 - Info Disclosure

Title source: llm

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1

Core 3

Core References

Broken Link x_refsource_misc

Permissions Required x_refsource_misc

Vendor Advisory x_refsource_confirm

CVSS v3 7.4

EPSS 0.0010

EPSS Percentile 27.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-862

Status published

Products (2)

gitlab/gitlab 13.0.0 (2 CPE variants)

gitlab/gitlab < 12.9.8 (2 CPE variants)

Published Jun 19, 2020

Tracked Since Feb 18, 2026