What’s Vulnerable › Vulnerabilities

CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-05-01
• EPSS: 94.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-12 · updated 2026-06-17
• Weakness: CWE-640

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Summary

GitLab CE/EE contains an improper access control flaw where password reset emails can be sent to an unverified email address, allowing account takeover. It affects versions 16.1 before 16.1.6, 16.2 before 16.2.9, 16.3 before 16.3.7, 16.4 before 16.4.5, 16.5 before 16.5.6, 16.6 before 16.6.4, and 16.7 before 16.7.2; CVSS is 9.8 critical. The flaw is listed in CISA KEV with active exploitation, a public exploit exists, and EPSS gives a 94.5% chance of exploitation in 30 days. Upgrade to 16.1.6, 16.2.9, 16.3.7, 16.4.5, or later fixed releases, or apply vendor mitigations or discontinue use if none are available.

تحتوي GitLab CE/EE على ثغرة في التحكم بالوصول تسمح بإرسال رسائل إعادة تعيين كلمة المرور إلى بريد إلكتروني غير مُتحقَّق منه، مما قد يتيح الاستيلاء على الحساب. تشمل الإصدارات 16.1 قبل 16.1.6 و16.2 قبل 16.2.9 و16.3 قبل 16.3.7 و16.4 قبل 16.4.5 و16.5 قبل 16.5.6 و16.6 قبل 16.6.4 و16.7 قبل 16.7.2، بدرجة خطورة 9.8 حرجة. الثغرة مدرجة في CISA KEV مع استغلال نشط، ويوجد استغلال عام، واحتمال الاستغلال خلال 30 يوماً 94.5% وفق EPSS. يجب الترقية إلى 16.1.6 أو 16.2.9 أو 16.3.7 أو 16.4.5 أو إصدارات لاحقة مُصلحة، أو تطبيق تخفيفات المورّد أو إيقاف استخدام المنتج إن لم تتوفر.

Affected products

• GitLab: from 16.1.0 before 16.1.6; from 16.2.0 before 16.2.9; from 16.3.0 before 16.3.7; from 16.4.0 before 16.4.5; from 16.5.0 before 16.5.6; from 16.6.0 before 16.6.4 — fixed in 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4

How to fix

Upgrade to a fixed version: GitLab 16.1.6, 16.2.9, 16.3.7, 16.4.5. Check the vendor advisory for mitigations.

References

• https://gitlab.com/gitlab-org/gitlab/-/issues/436084
• https://hackerone.com/reports/2293343
• https://gitlab.com/gitlab-org/gitlab/-/issues/436084
• https://hackerone.com/reports/2293343
• https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028

Get alerted when CVE-2023-7028 or the next vulnerability affects your stack