CVE-2023-7028
Weak Password Recovery Mechanism for Forgotten Password in GitLab
CVE-2023-7028 is a critical vulnerability (CVSS 10.0) in Gitlab, published January 12, 2024. CISA lists it as known to be exploited, since May 1, 2024. EUVD reports exploitation since May 1, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.5%, the 99th percentile. Fixed in gitlab 16.1.6.
- Severity
- 10.0 CriticalCVSS 3.1, CVE List
- Exploit chance
- 94.5%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
16.1.6gitlab +1 more
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Discussion
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gitlabBitnami | 16.1.0 up to 16.1.6, 16.2.0 up to 16.2.9, 16.3.0 up to 16.3.7, 16.4.0 up to 16.4.5, 16.5.0 up to 16.5.6, 16.6.0 up to 16.6.4, 16.7.0 up to 16.7.2 | 16.1.616.2.916.3.716.4.516.5.616.6.416.7.2 |
gitlabUbuntu:16.04:LTS | All versions, plus listed versions 8.4.3+dfsg-98.4.3+dfsg-128.5.8+dfsg-5 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | RandomRobbieBF/CVE-2023-7028 | 2024-01-12 |
| PoC in GitHub | Vozec/CVE-2023-7028 | 2024-01-12 |
| PoC in GitHub | duy-31/CVE-2023-7028 | 2024-01-12 |
| PoC in GitHub | googlei1996/CVE-2023-7028 | 2024-01-12 |
| PoC in GitHub | Esonhugh/gitlab_honeypot | 2024-01-18 |
| PoC in GitHub | yoryio/CVE-2023-7028 | 2024-01-18 |
| PoC in GitHub | Shimon03/CVE-2023-7028-Account-Take-Over-Gitlab | 2024-01-23 |
| PoC in GitHub | thanhlam-attt/CVE-2023-7028 | 2024-01-23 |
| PoC in GitHub | Trackflaw/CVE-2023-7028-Docker | 2024-01-25 |
| PoC in GitHub | mochammadrafi/CVE-2023-7028 | 2024-01-26 |
Show 11 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | hackeremmen/gitlab-exploit | 2024-01-28 |
| Exploit-DB | GitLab CE/EE < 16.7.2 - Password Reset | 2024-03-14 |
| PoC in GitHub | soltanali0/CVE-2023-7028 | 2024-07-25 |
| PoC in GitHub | gh-ost00/CVE-2023-7028 | 2024-08-21 |
| PoC in GitHub | sariamubeen/CVE-2023-7028 | 2025-02-17 |
| PoC in GitHub | Sornphut/CVE-2023-7028-GitLab | 2025-03-29 |
| PoC in GitHub | szybnev/CVE-2023-7028 | 2025-07-21 |
| PoC in GitHub | KameliaZaman/Exploiting-GitLab-CVE-2023-7028 | 2025-08-05 |
| PoC in GitHub | FearThePLOTO/GitLab-CVE-2023-7028 | 2026-09-06 |
| Metasploit | GitLab Password Reset Account Takeover | 2024-01-11 |
| Nuclei | GitLab - Account Takeover via Password Reset |
What each source reports
CVE List Score used
Weak Password Recovery Mechanism for Forgotten Password in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- Record
CVE-2023-7028- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-640
- Updated
- 2026-11-02
EUVDEUVD-2023-59219
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- Record
EUVD-2023-59219- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mgg5-84cv-fc3c
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16...
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- Record
GHSA-mgg5-84cv-fc3c- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-284, CWE-640
- Updated
- 2026-11-02
CISA KEVNo score
GitLab Community and Enterprise Editions Improper Access Control Vulnerability
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
- Record
CVE-2023-7028- Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- Record
CVE-2023-7028- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-640
- Updated
- 2026-11-02
OSV
Weak Password Recovery Mechanism for Forgotten Password in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- Record
CVE-2023-7028- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-640
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-7028
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- Record
UBUNTU-CVE-2023-7028- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVBIT-gitlab-2023-7028No score
Weak Password Recovery Mechanism for Forgotten Password in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- Record
BIT-gitlab-2023-7028- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
gitlab.com/gitlab-org/gitlab/-/issues/436084
hackerone.com/reports/2293343
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028
vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028
nvd.nist.gov/vuln/detail/CVE-2023-7028
about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released