PT-2026-3766 · Gitlab · Gitlab Ce/Ee

Ahacker1 · Published 2026-01-21 · Updated 2026-04-23 · CVE-2026-0723

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.6 through 18.8.1

Description GitLab CE/EE is affected by a high-severity issue that allows an attacker with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses. The issue stems from an unchecked return value weakness in GitLab's authentication services. The vulnerability could enable full account takeover, potentially leading to access, modification, or deletion of sensitive code repositories and cloud secrets. Exploitation could also lead to supply chain attacks. There is no information available regarding the number of affected devices worldwide.

Recommendations Upgrade to GitLab version 18.6.4 or later. Upgrade to GitLab version 18.7.2 or later. Upgrade to GitLab version 18.8.2 or later.

Exploit

Fix

DoS

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

BDU:2026-00975

BIT-GITLAB-2026-0723

CVE-2026-0723

Affected Products

Gitlab Ce/Ee

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0723.json · Exploit
• 🔥 https://hackerone.com/reports/3476052 · Exploit
• https://bdu.fstec.ru/vul/2026-00975 · Security Note
• https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-0723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0723 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2026-0723 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0723 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-0723 · Security Note
• https://ubuntu.com/security/CVE-2026-0723 · Vendor Advisory
• https://twitter.com/CVEnew/status/2014339293972512875 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0723 · Note
• https://twitter.com/ox0ffff/status/2014131726205800744 · Twitter Post
• https://twitter.com/ThreatSynop/status/2014009727911358919 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2014239157703393329 · Twitter Post