CVE-2026-15723
CVE-2026-15723 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
CVSS 8.2 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
gitlab
- Versions du logiciel
- ≥ 10.1, < 19.3.6: Concernée (semver)
- ≥ 19.4, < 19.4.3: Concernée (semver)
- ≥ 19.5, < 19.5.1: Concernée (semver)
Mettez à jour vers 19.3.6; Mettez à jour vers 19.4.3; Mettez à jour vers 19.5.1