CVE-2026-15723: GitLab (High, CVSS 8.2)
- CVSS
- 8.2 High (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 25.5% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- Weakness
- CWE-90
- Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N- Published
- Oct 22, 2026
What it is
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
Description from the National Vulnerability Database.
What to do
Check whether you run GitLab, then apply the vendor’s fix or mitigation from the advisories below.
ThreatRoundup coverage
GitLab’s CVSS 10 Regex Bug Reaches Back 12 Years to Version 7.0
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.