CVE-2023-7028

Q: What is the severity of CVE-2023-7028?

CVE-2023-7028 has a CVSS score of 10.0 (CRITICAL). This critical vulnerability in GitLab allows attackers to hijack user accounts by intercepting password reset emails sent to unverified email addresses. Attackers can take over any user account, including administrators, by exploiting the password reset mechanism. All GitLab CE/EE instances running affected versions are vulnerable.

10.0 CRITICAL

Authentication Bypass

📋 TL;DR

This critical vulnerability in GitLab allows attackers to hijack user accounts by intercepting password reset emails sent to unverified email addresses. Attackers can take over any user account, including administrators, by exploiting the password reset mechanism. All GitLab CE/EE instances running affected versions are vulnerable.

💻 Affected Systems

Products:

GitLab Community Edition
GitLab Enterprise Edition

Versions: 16.1 to 16.1.5, 16.2 to 16.2.8, 16.3 to 16.3.6, 16.4 to 16.4.4, 16.5 to 16.5.5, 16.6 to 16.6.3, 16.7 to 16.7.1

Operating Systems: All platforms running GitLab

Default Config Vulnerable: ⚠️ Yes

Notes: All deployments including self-managed, cloud, and on-premises installations are affected if running vulnerable versions.

📦 What is this software?

Gitlab by Gitlab

GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...

Learn more about Gitlab →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of GitLab instance with administrative access, leading to source code theft, data exfiltration, supply chain attacks, and lateral movement to connected systems.

🟠

Likely Case

Account takeover of regular users leading to unauthorized access to repositories, sensitive data exposure, and potential privilege escalation.

🟢

If Mitigated

Limited impact with proper email verification controls and monitoring, but still requires immediate patching due to critical nature.

🌐 Internet-Facing: HIGH - GitLab instances accessible from the internet are directly exploitable without authentication.

🏢 Internal Only: HIGH - Internal instances are still vulnerable to insider threats or compromised internal accounts.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires no authentication and has been publicly demonstrated. Attackers only need to trigger password reset for target accounts.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later

Vendor Advisory: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

Restart Required: Yes

Instructions:

1. Backup GitLab instance. 2. Update to patched version using package manager (apt/yum) or Omnibus installer. 3. Restart GitLab services. 4. Verify update completed successfully.

🔧 Temporary Workarounds

Disable password resets

linux

Temporarily disable password reset functionality to prevent exploitation

gitlab-rails console
ApplicationSetting.first.update!(allow_password_authentication: false)

🧯 If You Can't Patch

Implement network segmentation to restrict access to GitLab instance
Enable multi-factor authentication for all users and monitor for suspicious password reset attempts

🔍 How to Verify

Check if Vulnerable:

Check GitLab version via admin interface or run: sudo gitlab-rake gitlab:env:info | grep Version

Check Version:

sudo gitlab-rake gitlab:env:info | grep Version

Verify Fix Applied:

Confirm version is patched: sudo gitlab-rake gitlab:env:info | grep Version and ensure it matches patched versions

📡 Detection & Monitoring

Log Indicators:

Unusual volume of password reset requests
Password reset emails sent to unfamiliar email addresses
Multiple failed login attempts followed by password reset

Network Indicators:

Unusual patterns in password reset API calls
Requests to /users/password endpoint from suspicious IPs

SIEM Query:

source="gitlab" AND (event="password_reset" OR event="user_password_reset") | stats count by src_ip, user

📊 Metadata

CVE ID: CVE-2023-7028

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE: CWE-640

Published: January 12, 2024

Last Updated: October 24, 2025

🔗 References

https://gitlab.com/gitlab-org/gitlab/-/issues/436084 Exploit,Issue Tracking,Vendor Advisory
https://hackerone.com/reports/2293343 Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/436084 Exploit,Issue Tracking,Vendor Advisory
https://hackerone.com/reports/2293343 Permissions Required
https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028 Exploit,Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028 US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

Gitlab by Gitlab

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable password resets

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities