VYPR
← All advisories
Unrated severityCISA KEVNVD Advisory· Published Jan 12, 2024· Updated Oct 21, 2025

Weak Password Recovery Mechanism for Forgotten Password in GitLab

CVE-2023-7028

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • GitLab Inc./GitLabv5
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Range: 16.1
  • GitLab Inc./CE/EEllm-fuzzy
    Range: >=16.1, <16.1.6 || >=16.2, <16.2.9 || >=16.3, <16.3.7 || >=16.4, <16.4.5 || >=16.5, <16.5.6 || >=16.6, <16.6.4 || >=16.7, <16.7.2
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 16.1.0, < 16.1.6

Patches

Vulnerability mechanics

References

2

News mentions

1