CVE-2023-7028

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-640

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.1, < 16.1.6; >= 16.2, < 16.2.9; >= 16.3, < 16.3.7; >= 16.4, < 16.4.5; >= 16.5, < 16.5.6; >= 16.6, < 16.6.4; >= 16.7, < 16.7.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/436084Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/2293343Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/436084Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/2293343Permissions Required
https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028US Government Resource

Timeline

Published: Jan 12, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: May 1, 2024
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-70295.4The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in al CVE-2023-70306.4The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' shortcode in all versions u CVE-2023-70314.3Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial informa CVE-2023-70327.8A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain h CVE-2023-70335.3Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L CVE-2023-70355.4A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the CVE-2023-70365.4A vulnerability was found in automad up to 1.10.9. It has been classified as problematic. This affects the function upload of the file FileC CVE-2023-70378.8A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the f CVE-2023-70386.5A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file CVE-2023-70399.8A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexpo CVE-2023-70406.5A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown CVE-2023-70415.4A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some