CVE-2026-15723

8.2 Élevée

Publiée le 22/10/2026 à 03:16 · Modifiée le 22/10/2026 à 03:16 · Reçue · Source : cve@gitlab.com

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

Traduire en français

Produits concernés

GitLab

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.2 Élevée	cve@gitlab.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-90

Références

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/605977
https://hackerone.com/reports/3852192

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories