GitLab and CVE-2023-7028: why this password-reset flaw worried everyone
> TL;DR: CVE-2023-7028 allowed account takeover through password reset without user interaction in some GitLab versions. Here is why it left such a mark.
A flaw in a platform that concentrates code, secrets, and CI
GitLab published a critical security release in January 2024 explaining that CVE-2023-7028 allowed account takeover through the password reset workflow without user interaction. The official release notes assign it a CVSS 10.0 severity.
Why the impact goes beyond authentication
On GitLab, taking over an account does not only mean reading source code. It can also expose pipelines, secret variables, artifacts, registries, issue history, and deployment workflows.
What this says about DevOps platforms
Development platforms are risk multipliers. An authentication flaw there is not equivalent to an ordinary application login flaw. It can become a path into the internal supply chain.
The lesson for 2026
Teams need to review GitLab versions, MFA posture, audit logs, secret rotation, and logs related to suspicious password resets. GitLab itself recommended broader incident-response actions than a simple patch alone.
Our view
CVE-2023-7028 is a strong reminder that on DevOps platforms, an account flaw can quickly become an organizational flaw. The core risk is the concentration of power inside one platform.
Key Takeaways
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
GitLab RCE via Oj: a memory-corruption chain hidden in a non-security patch
Two Oj Ruby JSON parser bugs let any authenticated user run commands as `git` on self-managed GitLab <18.10.8 / <18.11.5 / <19.0.2, via crafted Jupyter notebooks. The fix shipped June 10 but was listed under bug fixes, not security. PoC published July 24.
GitLab CVE-2026-19478: Unauthenticated GraphQL Injection Exploited Within 48 Hours
CVE-2026-19478 (CVSS 9.4) lets an attacker with no credentials modify or delete public GitLab projects through a poorly validated GraphQL directive. Exploited in the wild within 48 hours of disclosure.
JetBrains TeamCity: a critical auth bypass leading to RCE on your CI/CD server
A critical authentication bypass vulnerability in JetBrains TeamCity On-Premises could be exploited for remote code execution on the CI/CD server — giving attackers access to build pipelines, deployment credentials, and source code. Fix available.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.