Loading story…
GitLab released security updates for Community Edition and Enterprise Edition to fix multiple vulnerabilities, led by CVE-2023-7028, a critical password reset flaw that could send reset emails to an unverified address and enable account takeover. The issue was assigned a CVSS 10.0 score, and GitLab said GitLab.com had already been patched while it had not detected abuse of the flaw on GitLab-managed platforms. The same release also addressed CVE-2023-5356, which involved abuse of Slack and Mattermost slash commands, along with CVE-2023-4812, CVE-2023-6955, and CVE-2023-2030.
GitLab initially shipped fixes in versions 16.7.2, 16.6.4, and 16.5.6, then advised customers to move to 16.7.3, 16.6.5, 16.5.7, or newer because of an additional database migration issue in the earlier patch set. The company urged self-managed administrators to upgrade promptly, enable 2FA, and review logs for signs of exploitation attempts, reflecting the severity of the account takeover risk and the broader exposure from the other patched flaws.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
After the 2024-01-11 security release, GitLab later told customers to upgrade further to versions 16.7.3, 16.6.5, 16.5.7, or newer because the earlier patch set had an additional DB migration issue. The source does not provide a specific date for this follow-up advisory.
On 2024-01-11, GitLab released versions 16.7.2, 16.6.4, and 16.5.6 for Community Edition and Enterprise Edition to fix multiple vulnerabilities, including the critical account takeover issue CVE-2023-7028. The release also addressed CVE-2023-5356, CVE-2023-4812, CVE-2023-6955, and CVE-2023-2030, and GitLab said GitLab.com was already patched.
The Dutch National Cyber Security Centre (NCSC) reported observing active attempts to exploit GitLab vulnerabilities, including CVE-2023-7028. The advisory also noted that public proof-of-concept exploit code had been published.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcedocs.gitlab.com
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourceabout.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released **19.0.2**, **18.11.5**, and **18.10.8** for self-managed Community Edition and Enterprise Edition deployments to fix **11 security vulnerabilities** and additional bugs, and urged administrators to upgrade immediately. The advisory says all versions before those releases are affected, while **GitLab.com** has already been patched and **GitLab Dedicated** customers do not need to take action. GitLab also warned that the update includes database migrations that may cause downtime on single-node instances, though multi-node environments can use zero-downtime upgrade procedures. The most severe issue, **`CVE-2026-6552`** (**CVSS 8.7**), is an improper authorization flaw in GitLab EE's Group SAML identity management that could let an authenticated **group Owner** take over another group member's account under certain conditions. GitLab also fixed **`CVE-2026-10087`**, an Analytics Dashboard cross-site scripting flaw in GitLab EE that could allow an authenticated **developer** to execute arbitrary client-side code in a victim's browser. The broader patch set addresses additional risks including denial of service in Grape API JSON parsing, SSRF, unauthorized access to confidential data, and other authorization bypasses, and government and vendor advisories have called on organizations to apply the patched versions.
Jul 25, 2026
GitLab released security updates for self-managed **GitLab Community Edition (CE)** and **Enterprise Edition (EE)** to fix a high-severity **two-factor authentication (2FA) bypass** and multiple **denial-of-service (DoS)** flaws. The most significant issue, **CVE-2026-0723** (CVSS 7.4), is an *unchecked return value* weakness in authentication services that could allow an attacker with knowledge of a victim’s credential/account ID to bypass 2FA by submitting forged device responses. GitLab also patched DoS vulnerabilities affecting unauthenticated and authenticated scenarios, including crafted malformed authentication data against the **Jira Connect** integration (**CVE-2025-13927**), incorrect authorization validation in API endpoints such as the **Releases API** (**CVE-2025-13928**), malformed Wiki documents that bypass cycle detection (**CVE-2025-13335**), and repeated malformed SSH authentication requests (**CVE-2026-1102**). Fixed releases are **18.8.2**, **18.7.2**, and **18.6.4**; GitLab advised administrators to upgrade immediately, noting *GitLab.com* is already patched, while third-party tracking indicated thousands of exposed GitLab CE instances remain online and potentially at risk if unpatched.
Jun 29, 2026
GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.
Jul 24, 2026