CVE-2026-15723: LDAP Account Takeover in GitLab CE/EE

CVE-2026-15723 is an account takeover vulnerability in GitLab Community Edition and Enterprise Edition. It affects versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. When administrators enable both OmniAuth with a SAML provider and LDAP auto-linking simultaneously, an authenticated user (even with minimal privileges) can take over an existing LDAP account without the target user's consent. The root cause is improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

With a CVSS score of 8.2 (High range), this vulnerability poses a significant threat to organizations using federated authentication. GitLab released patches on October 22, 2026, less than a week ago. On October 28, 2026, researchers reported an offline detector on GitHub for identifying exposed GitLab CE/EE instances, with capability to generate verifiable inventories in CSV and JSON formats. Exploitation in the wild is not confirmed at this time, but rapid release of detection tools indicates high risk awareness in the security community.

If you manage a self-managed GitLab instance, immediately verify your OmniAuth configuration: check whether both SAML and LDAP auto-linking are enabled (both conditions must be true for risk). If yes, update immediately to versions 19.3.6, 19.4.3, or 19.5.1 depending on your release branch. Until update, temporarily disable LDAP auto-linking. Review GitLab access logs (authentication log, identity linking log) to detect anomalous account linking attempts or unusual access patterns on LDAP accounts in the last 30 days.