CVE-2026-0723

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.6 through 18.8.1

Description GitLab CE/EE is affected by a high-severity issue that allows an attacker with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses. The issue stems from an unchecked return value weakness in GitLab's authentication services. The vulnerability could enable full account takeover, potentially leading to access, modification, or deletion of sensitive code repositories and cloud secrets. Exploitation could also lead to supply chain attacks. There is no information available regarding the number of affected devices worldwide.

Recommendations Upgrade to GitLab version 18.6.4 or later. Upgrade to GitLab version 18.7.2 or later. Upgrade to GitLab version 18.8.2 or later.