Critical severity10.0CISA KEVNVD Advisory· Published Jan 12, 2024· Updated Jun 17, 2026
CVE-2023-7028
CVE-2023-7028
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.1
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=16.1.0,<16.1.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=16.1.0,<16.1.6
- (no CPE)range: 16.1 - 16.7.2
- Range: 16.1 - 16.7.2
Patches
Vulnerability mechanics
References
4- gitlab.com/gitlab-org/gitlab/-/issues/436084nvdExploitIssue TrackingVendor Advisory
- www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028nvdExploitThird Party Advisory
- hackerone.com/reports/2293343nvdPermissions Required
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
1- GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6GitLab Security Releases · Jan 11, 2024