GitLab · GitLab CE/EE

CVE-2023-7028

Weak Password Recovery Mechanism for Forgotten Password in GitLab

Exploited in attacks Critical 10.0 Attack chance: 94%

What it is

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

CISA: GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: May 22, 2024

Added to the CISA list: May 1, 2024
Published: January 12, 2024
Severity: Critical 10.0 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 94% in the top 0.1% of all known vulnerabilities
Weakness: CWE-284
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from GitLab

Added	Vulnerability	Product	Severity	Attack chance
Sep 11, 2026	Path TraversalCVE-2026-85706	Community Edition and Enterprise Edition	Critical 10.0	97%
Feb 18, 2026	Server-Side Request Forgery (SSRF)CVE-2021-22175	GitLab	Medium 6.8	53%
Feb 3, 2026	Server-Side Request Forgery (SSRF)CVE-2021-39935	Community and Enterprise Editions	Medium 6.8	36%
Nov 3, 2021	Remote Code ExecutionCVE-2021-22205used by ransomware	Community and Enterprise Editions	Critical 10.0	99.7%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.