GitLab Vulnerability Exposes User Account Password Resets

What changed

An improper access control vulnerability has been identified in GitLab Community and Enterprise Editions. This issue affects multiple versions, allowing password reset emails to be sent to unverified email addresses, which could lead to unauthorized access.

Who is affected

The vulnerability impacts a wide range of users and organizations utilizing GitLab for version control and collaboration.

• GitLab Community Edition users across all affected versions.
• GitLab Enterprise Edition users across all affected versions.
• Organizations relying on GitLab for software development and project management.
• Any individual with an account on GitLab instances running the vulnerable versions.

What to do

It is crucial for affected users to update their GitLab installations to the latest versions to mitigate this vulnerability. Administrators should review their security policies regarding user account management.

• Upgrade to GitLab versions 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, or 16.7.2 or later.
• Implement additional verification steps for password reset requests.
• Monitor user accounts for any suspicious activity following the vulnerability disclosure.
• Educate users on the importance of securing their email accounts linked to GitLab.