← Vulnerability Intelligence

CVE-2023-7028

Critical 9.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
GitLab Community and Enterprise Editions Improper Access Control Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
94% (percentile: 100) as of 2 November 2026
CWE
CWE-640

Affected products

gitlab: gitlab

References