CVE-2026-0723

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0723", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-08T13:03:57.347Z", "datePublished": "2026-01-22T13:34:08.340Z", "dateUpdated": "2026-02-26T14:44:33.144Z"}, "containers": {"cna": {"title": "Unchecked Return Value in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "18.6", "status": "affected", "lessThan": "18.6.4", "versionType": "semver"}, {"version": "18.7", "status": "affected", "lessThan": "18.7.2", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-252: Unchecked Return Value", "cweId": "CWE-252", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/585333", "name": "GitLab Issue #585333", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3476052", "name": "HackerOne Bug Bounty Report #3476052", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.4, 18.7.2, 18.8.2 or above."}], "credits": [{"lang": "en", "value": "Thanks [ahacker1](https://hackerone.com/ahacker1) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-01-22T13:34:08.340Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0723", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T04:55:20.746057Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:33.144Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0723", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T04:55:20.746057Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:28:44.448Z"}}], "cna": {"title": "Unchecked Return Value in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [ahacker1](https://hackerone.com/ahacker1) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "18.6", "lessThan": "18.6.4", "versionType": "semver"}, {"status": "affected", "version": "18.7", "lessThan": "18.7.2", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.4, 18.7.2, 18.8.2 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/585333", "name": "GitLab Issue #585333", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3476052", "name": "HackerOne Bug Bounty Report #3476052", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-252", "description": "CWE-252: Unchecked Return Value"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-01-22T13:34:08.340Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0723", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:44:33.144Z", "dateReserved": "2026-01-08T13:03:57.347Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-01-22T13:34:08.340Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "18.6.4", "status": "affected", "version": "18.6", "versionType": "semver"}, {"lessThan": "18.7.2", "status": "affected", "version": "18.7", "versionType": "semver"}, {"lessThan": "18.8.2", "status": "affected", "version": "18.8", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "DCFE3D48-36BA-44C2-8F0D-38CFDB1A366D", "versionEndExcluding": "18.6.4", "versionStartIncluding": "18.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "1ED8B99B-2F16-48A4-A538-7FE3A8DBF3D3", "versionEndExcluding": "18.6.4", "versionStartIncluding": "18.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "7E36C974-4A52-424A-8758-E45B750C013E", "versionEndExcluding": "18.7.2", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "F71560B5-1000-45F1-8A5C-078D6C3D03E6", "versionEndExcluding": "18.7.2", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "582D13A9-DEEE-4E3F-BFC5-61F270C99B86", "versionEndExcluding": "18.8.2", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "760BBB79-D5BD-4871-8522-3C2C7E65767B", "versionEndExcluding": "18.8.2", "versionStartIncluding": "18.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 18.6 anterior a la 18.6.4, la 18.7 anterior a la 18.7.2, y la 18.8 anterior a la 18.8.2 que podr\u00eda haber permitido a un individuo con conocimiento existente del ID de credencial de una v\u00edctima omitir la autenticaci\u00f3n de dos factores al enviar respuestas de dispositivo falsificadas."}], "id": "CVE-2026-0723", "lastModified": "2026-06-17T10:11:15.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0723", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T04:55:20.746057Z", "version": "2.0.3"}}]}, "published": "2026-01-22T15:16:50.030", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/585333"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3476052"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-252"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:47:54.621981+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s recommended upgrade to GitLab 18.6.4 or later (or 18.7.2 or 18.8.2 and newer)", "Invalidate any potentially compromised credential IDs and re\u2011enroll 2FA devices for affected users", "Monitor authentication logs for suspicious forged device response attempts and set alerts for unauthorized 2FA activity"], "summary": {"action": "Immediate Patch", "impact": "Two\u2011factor authentication bypass using forged device responses"}, "threat_synthesis": {"affected_systems": "GitLab Community Edition and Enterprise Edition are affected. All releases from 18.6 prior to 18.6.4, 18.7 prior to 18.7.2, and 18.8 prior to 18.8.2 are vulnerable, regardless of the distribution (community or enterprise).", "description_and_impact": "The vulnerability arises from an unchecked return value that permits an attacker who knows a victim\u2019s credential ID to forge device responses. This flaw undermines GitLab\u2019s two\u2011factor authentication, allowing unauthorized authentication to the victim's account. The failure is identified as CWE\u2011252, exposing confidential account access and jeopardizing data integrity on all impacted installations.", "risk_and_exploitability": "The CVSS score of 7.4 signals a high severity level, while an EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not cataloged in the CISA Known Exploited Vulnerabilities list. The attack vector is remote, requiring an attacker with knowledge of a credential ID to submit forged device responses, which can then bypass two\u2011factor verification and grant the attacker access to the target account."}}}}, "created": "2026-04-18T04:00:08.404913+00:00", "updated": "2026-04-18T04:00:08.404927+00:00", "vendors": []}