PT-2025-26465 · Gitlab · Gitlab Ce/Ee

Published 2023-10-31 · Updated 2025-08-12 · CVE-2023-5600

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.0 through 16.3.5 GitLab EE versions 16.4 through 16.4.1 GitLab EE versions 16.5 through 16.5.0

Description: An issue has been discovered in GitLab EE where arbitrary access to the titles of private specific references could be leaked through the service-desk custom email template.

Recommendations: For versions 16.0 through 16.3.5, update to version 16.3.6 or later. For versions 16.4 through 16.4.1, update to version 16.4.2 or later. For versions 16.5 through 16.5.0, update to version 16.5.1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-07573

BIT-GITLAB-2023-5600

CVE-2023-5600

Affected Products

Gitlab Ce/Ee

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5600.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/428268 · Exploit
• 🔥 https://hackerone.com/reports/2209702 · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2023-5600 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5600 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5600 · Vendor Advisory
• https://twitter.com/CVEnew/status/1936472527221539291 · Twitter Post
• https://about.gitlab.com/releases/2023/10/31/security-release-gitlab-16-5-1-16-4-2-16-3-6-released · Note
• https://t.me/cvetracker/26701 · Telegram Post
• https://t.me/cveNotify/131815 · Telegram Post