CVE-2026-15723

waiting for further signals

EUVD-2026-107677 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

GitLab >= 10.1, < 19.3.6; >= 19.4, < 19.4.3; >= 19.5, < 19.5.1

fixed in 19.3.6, 19.4.3, 19.5.1

CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

ETK-2026-2372, permanent identifier

cvss8.2cna vendorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

1h 16msince last run

56mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+1h08m

+2h

+4h

+6h

+8h

+10h

+12h

description

GitLab CE/EE versions before 19.3.6, 19.4.3, and 19.5.1 are affected when OmniAuth SAML and LDAP auto-linking are both enabled. An authenticated user could take over an existing LDAP-backed account without action by the targeted user.

mitigation

Upgrade GitLab to 19.3.6, 19.4.3, or 19.5.1, as appropriate for your release line. Until upgraded, disable either OmniAuth SAML or LDAP auto-linking where operationally feasible.

fixed in 19.3.6, 19.4.3, 19.5.1

check

exploit

automation

contextual

auth required

yes, low privileges

EPSS

–

agent run time

56m

cve.org record, t = 0

2026-10-21 23:35Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-21 23:35Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-15723

this entry in the feed

GET /api/v1/feed/CVE-2026-15723

{
  "etk_id": "ETK-2026-2372",
  "cve_id": "CVE-2026-15723",
  "display_id": "CVE-2026-15723",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-107677",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Account takeover in GitLab SAML and LDAP auto-linking",
  "summary": "GitLab CE/EE versions before 19.3.6, 19.4.3, and 19.5.1 are affected when OmniAuth SAML and LDAP auto-linking are both enabled. An authenticated user could take over an existing LDAP-backed account without action by the targeted user.",
  "mitigation": "Upgrade GitLab to 19.3.6, 19.4.3, or 19.5.1, as appropriate for your release line. Until upgraded, disable either OmniAuth SAML or LDAP auto-linking where operationally feasible.",
  "vendor": "GitLab",
  "product": "GitLab",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 10.1, < 19.3.6",
        ">= 19.4, < 19.4.3",
        ">= 19.5, < 19.5.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "19.3.6",
        "19.4.3",
        "19.5.1"
      ],
      "package_name": "GitLab",
      "purl": null
    }
  ],
  "cwes": [
    90
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 55.71768453333333,
  "t0_at": "2026-10-21T23:35:15.434000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T23:35:15.434000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T23:35:15.434000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15723"
    }
  }
}

published 2026-10-21 23:47Z
last change 2026-10-22 01:47Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.