GitLab CE/EE: Account takeover via OmniAuth-to-LDAP auto-linking
Summary
When OmniAuth SAML and LDAP auto-linking are both enabled, GitLab CE/EE versions from 10.1 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1 are affected. An authenticated user can take over an existing LDAP-backed account without any action by the targeted user, because the LDAP email lookup during OmniAuth identity linking does not sanitise input properly. The CVSS 3.1 base score is 8.2 (high), but the attack complexity is high. CISA SSVC reports no known exploitation and no automatable attack, with total technical impact.
Affected
- GitLab CE/EE from 10.1 before 19.3.6
- GitLab CE/EE 19.4 before 19.4.3
- GitLab CE/EE 19.5 before 19.5.1
- Only instances with both OmniAuth SAML and LDAP auto-linking enabled are affected (default: unaffected)
Fixed in
- 19.3.6
- 19.4.3
- 19.5.1
- Or any later version
- Backports to 19.2.x, 19.1.x, 19.0.x and 18.11.x do not include this fix according to the vendor's advisory; upgrade to a fixed version instead
Workaround
No vendor workaround.
- Disable OmniAuth SAML or LDAP auto-linking until the update is installed
Exploitation
- No public exploitation known at the time of the entry.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- The attacker needs a valid authenticated account on the instance.
Our recommendation
- Upgrade affected self-managed GitLab instances to 19.3.6, 19.4.3, 19.5.1 or later as soon as possible.
- Check whether OmniAuth SAML and LDAP auto-linking are enabled and disable auto-linking if the update cannot be installed immediately.
- Review recent account linking and LDAP-backed account changes for unexpected activity.
- GitLab.com and GitLab Dedicated are already patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitLab Critical Patch Release 19.5.1 (vendor advisory) docs.gitlab.com
- GitLab work item 605977 gitlab.com
- HackerOne report 3852192 hackerone.com
- heise: GitLab fixes critical security flaw and 11 other vulnerabilities www.heise.de
- Konfirmity: GitLab Critical Patch Release 19.5.1 www.konfirmity.com
- CVE-2026-15723 (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:14.
Original description (NVD)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.