# CVE-2023-7028: Weak Password Recovery Mechanism for Forgotten Password in GitLab

> CVE-2023-7028: Weak Password Recovery Mechanism for Forgotten Password in GitLab. CVSS 10.0 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2023-7028
Last updated: 2026-08-15T04:10:51Z

- Published: 2024-01-12 13:56 UTC · Updated: 2026-08-15 04:10 UTC · Assigner: GitLab
- CVSS: 10.0 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- EPSS: 94.5%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2024-05-01, federal due date 2024-05-22, ransomware use: Unknown
- CWE: CWE-640

## Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

## CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

## Affected vendors and products

- GitLab: GitLab

## Tracked companies

- [GitLab](https://rewindex.com/company/gitlab.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2023-7028)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2023-7028)
- [https://gitlab.com/gitlab-org/gitlab/-/issues/436084](https://gitlab.com/gitlab-org/gitlab/-/issues/436084)
- [https://hackerone.com/reports/2293343](https://hackerone.com/reports/2293343)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2023-7028 · Markdown: https://rewindex.com/cve/CVE-2023-7028.md · JSON: https://rewindex.com/api/v1/cves/CVE-2023-7028 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:09:26.595Z