CVE-2026-15723 GitLab CVE debrief

Who should care

GitLab administrators and security teams should assess exposure and prioritize remediation, especially in environments with OmniAuth SAML and LDAP auto-linking enabled, to prevent potential unauthorized access and data breaches. They should verify if the GitLab instance is affected by checking the version and configuration, and update to a remediated version as soon as possible.

Why it matters

CVE-2026-15723 is a high-severity vulnerability in GitLab CE/EE that allows authenticated users to take over existing LDAP-backed accounts when certain configurations are enabled. Defenders should prioritize verifying and remediating this vulnerability, especially in environments with OmniAuth SAML and LDAP auto-linking enabled, to prevent potential unauthorized access and data breaches.

• Account takeover risk for LDAP-backed accounts
• Potential unauthorized access to sensitive information
• Need for verification of affected versions and configurations
• Priority for updating to remediated versions

Technical summary

The vulnerability affects GitLab CE/EE versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. An authenticated user can take over an existing LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both enabled, due to improper input sanitization in the LDAP email lookup path. This issue allows for potential unauthorized access and data breaches in environments with these configurations enabled. Defenders should prioritize verifying and remediating this vulnerability, especially in environments with OmniAuth SAML and LDAP auto-linking enabled.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their GitLab instances, especially those with OmniAuth SAML and LDAP auto-linking enabled.

Recommended defensive actions

• Verify if the GitLab instance is affected by checking the version and configuration.
• Disable OmniAuth SAML and LDAP auto-linking if not required.
• Update to a remediated version (19.3.6, 19.4.3, or 19.5.1) as soon as possible.
• Monitor for suspicious activity related to account takeovers.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the affected versions and the nature of the vulnerability. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.