{"id":"CVE-2026-15723","kind":"vulnerability","aliases":["CVE-2026-15723"],"related":[],"title":"GitLab CE/EE: SAML and LDAP auto-linking lets users take over LDAP accounts","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.","summary":"When OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated GitLab user can take over an existing LDAP-backed account. The flaw is improper input sanitization in the LDAP email lookup used during OmniAuth identity linking, and no action from the victim is needed.","severity":"high","cvss":8.2,"epss":0.00334,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitlab","infrastructure","ldap","saml","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"- Run `grep -i -A3 'omniauth' /etc/gitlab/gitlab.rb` and check whether SAML is enabled.\n- Check `gitlab.rb` for LDAP auto-linking settings (`auto_link_ldap_user` or equivalent) being enabled.\n- Check the installed version with `gitlab-rake gitlab:env:info` and compare against the fixed versions.","fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3`, or `19.5.1` depending on the release line you run.\n- If you cannot upgrade, disable OmniAuth SAML or LDAP auto-linking until the upgrade is applied.","status":"open","published_at":"2026-10-22T01:16:59+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:03:46+00:00","updated_at":"2026-10-25T03:03:46+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:03:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3`, or `19.5.1` depending on the release line you run.\n- If you cannot upgrade, disable OmniAuth SAML or LDAP auto-linking until the upgrade is applied.","reach":"network","title":"GitLab CE/EE: SAML and LDAP auto-linking lets users take over LDAP accounts","impact":"high","summary":"When OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated GitLab user can take over an existing LDAP-backed account. The flaw is improper input sanitization in the LDAP email lookup used during OmniAuth identity linking, and no action from the victim is needed.","category":"infrastructure","nicknames":[],"who_cares":["gitlab","self-hosted","ldap","saml"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over an existing LDAP-backed GitLab account without victim action.","analyst_note":"Confirm the exact affected configuration and the fixed version per release line from the GitLab advisory, which the NVD entry links to.","how_to_check":"- Run `grep -i -A3 'omniauth' /etc/gitlab/gitlab.rb` and check whether SAML is enabled.\n- Check `gitlab.rb` for LDAP auto-linking settings (`auto_link_ldap_user` or equivalent) being enabled.\n- Check the installed version with `gitlab-rake gitlab:env:info` and compare against the fixed versions.","needs_analyst":true,"not_affected_if":["default-config","managed-hosting"],"who_is_affected":"Self-managed GitLab CE or EE instances from 10.1 up to the fixed releases that have both OmniAuth SAML and LDAP auto-linking enabled. Instances without both features enabled, and GitLab.com-style managed hosting handled by the vendor, are not described as exposed by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":3437,"output_tokens":716,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-15723':17A,20A '-2026':16A,19A '10.1':88C '19.3.6':90C '19.4':91C '19.4.3':93C '19.5':95C '19.5.1':97C 'account':14A,51B,122C 'action':70B 'affect':84C 'authent':40B,111C 'auto':7A,34B,105C 'auto-link':6A,33B,104C 'back':50B,121C 'ce/ee':2A,83C 'could':113C 'cve':15A,18A 'due':130C 'email':61B,138C 'enabl':38B,109C 'exist':47B,118C 'flaw':53B 'gitlab':1A,21B,41B,76C,82C 'host':27B 'ident':66B,144C 'improp':55B,132C 'infrastructur':22B 'input':56B,133C 'interact':125C 'issu':80C 'ldap':5A,13A,23B,32B,49B,60B,103C,120C,137C 'ldap-back':48B,119C 'let':9A 'link':8A,35B,67B,106C,145C 'lookup':62B,139C 'need':75B 'omniauth':29B,65B,100C,143C 'path':140C 'remedi':78C 'saml':3A,24B,30B,101C 'sanit':57B,134C 'self':26B 'self-host':25B 'take':11A,44B 'taken':115C 'target':128C 'use':63B,141C 'user':10A,42B,112C,129C 'version':86C 'victim':73B 'without':123C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab CE or EE instances from 10.1 up to the fixed releases that have both OmniAuth SAML and LDAP auto-linking enabled. Instances without both features enabled, and GitLab.com-style managed hosting handled by the vendor, are not described as exposed by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15723","severity":null,"published_at":"2026-10-22T01:16:59+00:00","modified_at":"2026-10-23T12:18:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-15723","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-15723","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}