GitLab and CVE-2023-7028: why this password-reset flaw worried everyone
> TL;DR: CVE-2023-7028 allowed account takeover through password reset without user interaction in some GitLab versions. Here is why it left such a mark.
A flaw in a platform that concentrates code, secrets, and CI
GitLab published a critical security release in January 2024 explaining that CVE-2023-7028 allowed account takeover through the password reset workflow without user interaction. The official release notes assign it a CVSS 10.0 severity.
Why the impact goes beyond authentication
On GitLab, taking over an account does not only mean reading source code. It can also expose pipelines, secret variables, artifacts, registries, issue history, and deployment workflows.
What this says about DevOps platforms
Development platforms are risk multipliers. An authentication flaw there is not equivalent to an ordinary application login flaw. It can become a path into the internal supply chain.
The lesson for 2026
Teams need to review GitLab versions, MFA posture, audit logs, secret rotation, and logs related to suspicious password resets. GitLab itself recommended broader incident-response actions than a simple patch alone.
Our view
CVE-2023-7028 is a strong reminder that on DevOps platforms, an account flaw can quickly become an organizational flaw. The core risk is the concentration of power inside one platform.
Key Takeaways
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
GitLab RCE via Oj: a memory-corruption chain hidden in a non-security patch
Two Oj Ruby JSON parser bugs let any authenticated user run commands as `git` on self-managed GitLab <18.10.8 / <18.11.5 / <19.0.2, via crafted Jupyter notebooks. The fix shipped June 10 but was listed under bug fixes, not security. PoC published July 24.
GitLab CVE-2026-85706: Unauthenticated Arbitrary File Read (CVSS 10), Scanned Within Hours
A path traversal in the repository commits API (CVE-2026-85706, CVSS 10.0) lets an unauthenticated user read arbitrary files from the GitLab server — logs and configuration holding credentials and secrets — as soon as one public project exists. Active probes observed September 11; CISA KEV with a September 14 deadline. Fixes: 19.1.8, 19.2.6, 19.3.2, also covering an EE deserialization flaw (CVE-2026-87719, 9.9).
GitLab CVE-2026-19478: Unauthenticated GraphQL Injection Exploited Within 48 Hours
CVE-2026-19478 (CVSS 9.4) lets an attacker with no credentials modify or delete public GitLab projects through a poorly validated GraphQL directive. Exploited in the wild within 48 hours of disclosure.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.