CVE-2026-15723 | Vulnetix

CVE-2026-15723 PUBLISHED CVSS 8.2 HIGH

Reported by gitlab · Published October 21, 2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
GitLab	GitLab	19.5.1, 19.4.3, 19.3.6

Risk scores

CVSS 3.1

8.2

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

Vendor	Product	Versions
GitLab	GitLab	10.1, 19.4, 19.5
GitLab	GitLab	10.1, 19.4, 19.5

Timeline

Oct 21, 2026 CVE Published
Oct 22, 2026 EPSS Score (3 in total, the first dated here)
Oct 23, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-15723
vulnetix vdb fixes CVE-2026-15723

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-15723/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

HackerOne Bug Bounty Report #3852192 technical-descriptionexploitpermissions-required

Look up in the Resolve Platform →