GitLab
GitLab Community and Enterprise Editions Access Control Flaw Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on GitLab, treat it as High.
Briefing
- Organisations using affected GitLab versions should prioritise upgrading to the latest releases to mitigate potential exploitation risks.
Questions to ask IT
- Do we run GitLab, and is every instance on a fixed release (16.1.6, 16.2.9, 16.3.7, 16.4.5 or 3 more, or later)?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2023-7028- 10.0 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and integrity, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Listed: attacks using it have been seen
- Elevated attack likelihood (~94.5% in 30 days)
- 16.1 before 16.1.6, 16.2 before 16.2.9, 16.3 before 16.3.7, 16.4 before 16.4.5, 16.5 before 16.5.6, 16.6 before 16.6.4, 16.7 before 16.7.2
- 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2
Versions are as the CVE record states them; check the vendor advisory before planning a fix.
- Versions 16.7.2, 16.6.4, and 16.5.6 of GitLab CE and EE include security fixes for the vulnerability.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- GitLab has released updated versions to address an improper access control vulnerability affecting both Community and Enterprise Editions.
- The vulnerability is identified as CVE-2023-7028 and has been confirmed as exploited in the wild.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- GitLab93% match confidence · CVE-2023-7028
Pulse
Last checked 22h ago · Next recheck 8 Nov 2026, 17:36 UK time
- Story3 Nov 2026, 18:21 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
GitLab Community and Enterprise Editions Improper Access Control Vulnerability
- ProbableSummary fact75% confidence
On 11 January 2024, we released versions 16.7.2, 16.6.4, 16.5.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2023-7028
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2023-7028 is confirmed as exploited in the wild (US known-exploited catalogue)