Loading vulnerability…
Two-factor authentication bypass in GitLab CE/EE
CVE-2026-0723 is an unchecked return value vulnerability in GitLab Community Edition and Enterprise Edition authentication services. An attacker with existing knowledge of a victim's credential ID can submit forged device responses to bypass two-factor authentication, potentially gaining unauthorized account access. Affected versions are 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2. The vulnerability is rated high severity with a CVSS v3.1 score of 7.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can enable account takeover despite two-factor authentication, compromising the confidentiality and integrity of resources accessible to the victim. Depending on account permissions, this can expose source code and sensitive credentials and permit unauthorized modifications. The CVSS v3.1 vector assigns high confidentiality and integrity impacts and no direct availability impact.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is established. Pending patching, restrict access to trusted networks through VPN or IP allowlists where feasible, monitor for anomalous authentication activity, and avoid exposing credential IDs through logs or integrations. These measures reduce exposure but do not correct the authentication flaw.
Patch, then assume compromise.
Upgrade affected self-managed GitLab CE/EE installations to 18.6.4, 18.7.2, or 18.8.2 for the corresponding release branch, or a subsequent fixed release. These fixes were released on January 21, 2026. The updates include database migrations that can cause downtime on single-node deployments; multi-node deployments should follow GitLab's zero-downtime upgrade procedures where applicable. GitLab's hosted service was already patched at release, and GitLab Dedicated customers required no action. Patching prevents subsequent exploitation but does not resolve any prior account compromise.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.