CVE-2023-7028

GitLab exploited an access control flaw to send password reset emails to unverified addresses, enabling account takeovers.

This improper access control vulnerability allowed attackers to bypass email verification requirements and trigger password resets for unverified accounts, facilitating account takeovers. For DIB organizations using GitLab for CI/CD or code management, this exposes sensitive credentials and source code to unauthorized access, requiring immediate patching and verification of email verification workflows.

Shame score — A critical access control flaw that was actively exploited but did not involve remote code execution or supply chain compromise.