CVE-2026-15723: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which GitLab deployments are exposed?
The issue affects GitLab CE/EE versions from 10.1 through versions before 19.3.6, 19.4.3, and 19.5.1, but only where both OmniAuth SAML and LDAP auto-linking are enabled.
What does an attacker need to exploit this issue?
An attacker needs an authenticated GitLab account. Exploitation does not require interaction from the user whose LDAP-backed account is targeted.
What is the impact of successful exploitation?
A successful attacker could take over an existing LDAP-backed account. The vulnerability is in the LDAP email lookup used while linking an OmniAuth identity.
What versions contain the remediation?
GitLab remediated the issue in 19.3.6, 19.4.3, and 19.5.1. Upgrade to the applicable fixed release for your supported version line.