Key points
- GitLab fixed CVE-2026-15723 in versions 19.3.6, 19.4.3, and 19.5.1.
- The flaw affects installations using both OmniAuth SAML and LDAP auto-linking.
- Attackers could take over existing LDAP-backed accounts without user interaction.
GitLab has released security updates for its Community Edition and Enterprise Edition to address a high-severity vulnerability. The National Vulnerability Database lists this issue as CVE-2026-15723 with a CVSS score of 8.2. The patches are available for versions 19.3.6, 19.4.3, and 19.5.1. Any installation running a version prior to these specific releases is affected by the flaw.
In plain English
This vulnerability allows an attacker who already has an account to take over another user's account. This happens only when two specific features are active at the same time: OmniAuth SAML and LDAP auto-linking. The problem stems from improper input sanitization in the LDAP email lookup path. This flaw exists during the process of linking identities via OmniAuth.
The background
The issue impacts all GitLab CE and EE versions starting from 10.1 up to the patched releases. According to the NVD record, the weakness is categorized under CWE-90. The vulnerability enables an authenticated user to assume control of an existing LDAP-backed account. This takeover occurs without any interaction from the targeted user, making it a silent and severe risk for organizations using these integration methods.
What changes now
Administrators must update their GitLab instances to the latest patched versions. The fix addresses the improper input sanitization in the LDAP email lookup path. By upgrading to version 19.3.6, 19.4.3, or 19.5.1, users eliminate the vector that allowed account takeover. GitLab has confirmed that these specific releases remediate the issue described in CVE-2026-15723.
Who needs to act first
Teams should prioritize updating systems that have both OmniAuth SAML and LDAP auto-linking enabled. Check internal documentation to identify which environments use these specific integrations. Before applying the update, back up the current instance to prevent data loss during the process. Test the upgrade in a non-production environment first to ensure compatibility with existing workflows. Monitor logs for any unusual authentication activity during the transition period.
What to do and how to stay safe: GitLab
- Verify if your GitLab instance has both OmniAuth SAML and LDAP auto-linking enabled.
- Upgrade to GitLab CE/EE version 19.3.6, 19.4.3, or 19.5.1 as soon as possible.
- Review authentication logs for signs of unauthorized account linking or takeover attempts.
- Disable LDAP auto-linking temporarily if an immediate update is not feasible.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which GitLab versions are vulnerable to CVE-2026-15723?
Versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 are affected.
Is there a patch available for this vulnerability?
Yes, GitLab has released fixes in versions 19.3.6, 19.4.3, and 19.5.1.
What conditions are required for this attack to succeed?
Both OmniAuth SAML and LDAP auto-linking must be enabled for the vulnerability to be exploitable.
