CVE-2023-7028: GitLab CE/EE password reset sent to unverified email, enabling account takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated, no-interaction account takeover with a 9.8 CVSS, KEV listing and near-maximum EPSS makes this an urgent patch-first item.

What it is

GitLab CE/EE versions from 16.1 through 16.7 before their fixed releases could deliver account password reset emails to an unverified email address. An attacker who controls or can add an unverified address on a target account can receive the reset link and take over that account. The flaw is a weak password recovery design (CWE-640) and carries a critical CVSS of 9.8.

Impact

An attacker gains full control of a targeted GitLab user account, including any repositories, tokens and permissions that account holds. Because the vector is unauthenticated and needs no user interaction, compromise can be automated at scale.

Attack surface

Reachable over the network through the GitLab password reset flow; the CVSS vector shows no privileges and no user interaction required. The reset email is simply directed to an unverified address, so the victim does not need to click anything.

Exploitation

CVE-2023-7028 is listed in CISA KEV with a 2024-05-22 remediation due date, and reference tags include Exploit and Third Party Advisory. EPSS is 0.94647 (99.851st percentile), indicating very high likelihood of exploitation activity.

What to do

• Upgrade GitLab CE/EE to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4 or 16.7.2 (or later) as applicable to your track.
• If immediate upgrade is not possible, follow the vendor's mitigation guidance referenced in the CISA KEV entry or discontinue use of the affected instance.
• Enable and enforce two-factor authentication on all GitLab accounts to reduce the value of a stolen reset flow.
• Audit account email addresses and remove or verify any unverified secondary addresses.
• Restrict network exposure of GitLab instances to trusted networks until patched.

Detection

• Review GitLab authentication logs for password reset requests and subsequent logins from new IPs or user agents.
• Alert on password reset events where the destination email differs from the account's primary verified address.
• Monitor for mass or scripted password reset requests across many accounts in a short window.
• Correlate successful logins immediately following a password reset with anomalous source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.