GitLab CE/EE Account Takeover via Password Reset Vulnerability (CVE-2023-7028) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTGitLab CE/EE versions 16.1 to 16.7.1 (prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2)
An unauthenticated remote attacker can trigger password reset emails to be sent to an arbitrary, unverified email address, leading to complete account takeover.
Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA).
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Execute the following commands to upgrade your GitLab instance to a secure version immediately.
# For Ubuntu/Debian Omnibus GitLab installations
sudo apt-get update
sudo apt-get install --only-upgrade gitlab-ce
# Or pin to a specific patched version (e.g., 16.7.2)
sudo apt-get install gitlab-ce=16.7.2-ce.0
# For CentOS/RHEL Omnibus GitLab installations
sudo yum update gitlab-ce
# Or pin to a specific patched version
sudo yum install gitlab-ce-16.7.2-ce.0.el82. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, enforce Multi-Factor Authentication (MFA/2FA) globally. While MFA does not prevent the password reset email from being sent, it prevents the attacker from logging in with the newly set password. Additionally, block external access to the password reset endpoint.
# Example Nginx configuration to block password reset requests
location /users/password {
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Inspect GitLab logs to identify potential exploitation attempts where multiple email addresses were submitted in password reset requests.
# Search production_json.log for password reset requests containing array-based email parameters
grep '"action":"create"' /var/log/gitlab/gitlab-rails/production_json.log | grep '"controller":"Decidim::PasswordsController"' | grep -E 'user\[email\]\[\]'
# Search audit_json.log for suspicious password or email modification events
grep -E 'password|email' /var/log/gitlab/gitlab-rails/audit_json.logScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-7028) is an input validation flaw (CWE-640) in GitLab's password reset mechanism. The root cause lies in the password reset controller's failure to validate the ownership or verification status of secondary email addresses supplied in the reset request. This allows an attacker to append an arbitrary email address to the password reset payload, which GitLab processes without proper validation.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a crafted HTTP POST request to the GitLab password reset endpoint (/users/password). By passing the user[email] parameter as an array (e.g., user[email]=victim@target.com&user[email]=attacker@evil.com), the application identifies the target account using the first email address but transmits the password reset token to all email addresses specified in the array. The attacker receives the reset link on their controlled inbox, allowing them to reset the victim's password and hijack the account without any user interaction.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk to enterprise environments. GitLab serves as a critical repository for intellectual property, CI/CD pipelines, and deployment credentials. Successful exploitation leading to administrative account takeover can result in proprietary source code theft, credential harvesting, and malicious code injection into production pipelines (Supply Chain Attack).
Official Vendor Advisories & References
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Frequently Asked SecOps Questions (CVE-2023-7028)
FAQQ1. How critical is CVE-2023-7028 and is it actively exploited in the wild?
CVE-2023-7028 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 94.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-7028?
Primary impacted vendors include gitlab across gitlab. Scope summary: GitLab CE/EE versions 16.1.0 through 16.1.5, 16.2.0 through 16.2.8, 16.3.0 through 16.3.6, 16.4.0 through 16.4.4, 16.5.0 through 16.5.5, 16.6.0 through 16.6.3, and 16.7.0 through 16.7.1
Q3. What temporary mitigations or workarounds exist for CVE-2023-7028 before patching?
[Mitigation] Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA). Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-7028
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gitlab)
View Category →GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
JFrog Artifactory Authentication Bypass and Administrative Privilege Escalation (CVE-2026-82329)
[Affected Scope] JFrog Artifactory Self-Managed instances running under default configurations
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.