# CVE-2023-7028: GitLab Community and Enterprise Editions Improper Access Control Vulnerability

Source: https://junglewise.ai/threats/cve-2023-7028-gitlab-community-and-enterprise-editions-improper-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-01. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2023-7028 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2024-05-01

GitLab Community and Enterprise Editions contain an improper access control vulnerability that allows password reset emails to be sent to unverified email addresses. An attacker can exploit this to trigger a password reset for a target account and redirect the recovery email to an address under their control, facilitating full account takeover.

Technologies: [GitLab EE](https://junglewise.ai/threats/technologies/ee), [GitLab CE](https://junglewise.ai/threats/technologies/gitlab-ce), [GitLab EE](https://junglewise.ai/threats/technologies/gitlab-ee). Vendors: [GitLab](https://junglewise.ai/threats/vendors/gitlab).

## Quick answers

**Is CVE-2023-7028 exploited in the wild?** Yes. CVE-2023-7028 is known to be exploited in the wild, first recorded on 1 May 2024. Treat it as urgent.

**How severe is CVE-2023-7028?** Critical severity, with a CVSS score of 9.8, published 1 May 2024.

**Which products and versions are affected?** GitLab GitLab Community Edition (CE) 16.1 to < 16.1.6, 16.2 to < 16.2.9, 16.3 to < 16.3.7, 16.4 to < 16.4.5, 16.5 to < 16.5.6, 16.6 to < 16.6.4, 16.7 to < 16.7.2; GitLab GitLab Enterprise Edition (EE) 16.1 to < 16.1.6, 16.2 to < 16.2.9, 16.3 to < 16.3.7, 16.4 to < 16.4.5, 16.5 to < 16.5.6, 16.6 to < 16.6.4, 16.7 to < 16.7.2.

**Is there a fix for CVE-2023-7028?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-7028 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-7028?** Check whether you run GitLab EE, GitLab CE or GitLab EE. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- GitLab GitLab Community Edition (CE) 16.1 to < 16.1.6, 16.2 to < 16.2.9, 16.3 to < 16.3.7, 16.4 to < 16.4.5, 16.5 to < 16.5.6, 16.6 to < 16.6.4, 16.7 to < 16.7.2
- GitLab GitLab Enterprise Edition (EE) 16.1 to < 16.1.6, 16.2 to < 16.2.9, 16.3 to < 16.3.7, 16.4 to < 16.4.5, 16.5 to < 16.5.6, 16.6 to < 16.6.4, 16.7 to < 16.7.2

## Timeline

- 2024-05-01: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2024-05-01: disclosed

## Related threats

- [GitLab authorization bypass in group milestones API](https://junglewise.ai/threats/cve-2026-13319-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab CE/EE improper access control in GraphQL work item email field](https://junglewise.ai/threats/cve-2026-12664-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab integer overflow in regular expression compiler](https://junglewise.ai/threats/cve-2026-110264-an-issue-has-been-discovered-in-gitlab-ce-ee-affecting-all)
- [GitLab CE/EE integer overflow in CI/CD regular expression compiler](https://junglewise.ai/threats/cve-2026-97229-gitlab-has-remediated-an-issue-in-gitlab-ce-ee-affecting-all)
- [GitLab EE incorrect authorization in merge request approval eligibility](https://junglewise.ai/threats/cve-2026-92528-gitlab-has-remediated-an-issue-in-gitlab-ee-affecting-all)