CVE-2023-7028

Weak Password Recovery Mechanism for Forgotten Password in GitLab

State: Published
Severity: 10.0 Critical
Published: Jan 12, 2024
Updated: Aug 15, 2026
Reserved: Dec 20, 2023

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N	GitLab

Weaknesses

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Affected Products

Product	Versions
GitLabGitLab	16.1 to before 16.1.6Affected 16.2 to before 16.2.9Affected 16.3 to before 16.3.7Affected 16.4 to before 16.4.5Affected 16.5 to before 16.5.6Affected 16.6 to before 16.6.4Affected 16.7 to before 16.7.2Affected

References

GitLab Issue #436084issue-tracking
HackerOne Bug Bounty Report #2293343technical-descriptionexploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028government-resource
https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.