ACTIVELY EXPLOITED
CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability
| Vendor | GitLab |
|---|---|
| Product | GitLab CE/EE |
| Actively exploited | Yes |
| Added to CISA KEV | 1 May 2024 |
| CISA federal deadline | 22 May 2024 |
| Weakness (CWE) | CWE-284 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
SOURCES
Other GitLab flaws
- CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- CVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- CVE-2021-22175: GitLab Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2021-22205: GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.