CVE-2026-15723
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4…
- Risk score
- 54/100
- CVSS
- 8.2 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the target…
- Affected
- See advisory
- Fix
- Upgrade the product to 19.3.6, 19.4, 19.4.3, 19.5 or 19.5.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.2 high
References
Original description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
Last activity 22 Oct 2026. Patch Forecast updates every hour.