--- title: "Urgent Security Alert: Critical Flaws in GitLab Require Immediate Action" description: Critical security vulnerabilities in GitLab require immediate action. Learn about the flaws, their impact, and protective measures in this urgent security alert. image: https://www.iflockconsulting.com/hubfs/AdobeStock_443702077.jpeg --- [![iflockconsulting Favicon blue-01-1](https://www.iflockconsulting.com/hs-fs/hubfs/iflockconsulting%20Favicon%20blue-01-1.png?width=2083&height=2086&name=iflockconsulting%20Favicon%20blue-01-1.png "iflockconsulting Favicon blue-01-1")](https://www.iflockconsulting.com/) - [Solutions](https://www.iflockconsulting.com/services) - [Audit Readiness](https://www.iflockconsulting.com/audit-readiness) - [MSSP Program](https://www.iflockconsulting.com/services-mssp-program) - [Vulnerability Management](https://www.iflockconsulting.com/services-vulnerability-management) - [Compliance & Risk Management](https://www.iflockconsulting.com/services-compliance-risk) - [Professional Services](https://www.iflockconsulting.com/services-professional-services) - [Phishing Campaigns](https://www.iflockconsulting.com/phishing-campaigns/) - [PCI Compliance](https://www.iflockconsulting.com/pci-compliance/) - [Penetration Testing](https://www.iflockconsulting.com/penetration-testing) - Partner Ecosystem - [Industry Partners](https://www.iflockconsulting.com/industry-partners) - [Technology Partners](https://www.iflockconsulting.com/partner-ecosystem) - [Partner Referral Program](https://www.iflockconsulting.com/referral-program) - About Us - [FAQs](https://www.iflockconsulting.com/faq) - [Blog](https://www.iflockconsulting.com/blog) - [Events & Webinars](https://www.iflockconsulting.com/cybersecurity-events-webinars) - [Contact](https://www.iflockconsulting.com/contact-us) 1-833-4-HAXORS [tel:18334429677](tel:18334429677) - [Solutions](https://www.iflockconsulting.com/services) - [Audit Readiness](https://www.iflockconsulting.com/audit-readiness) - [MSSP Program](https://www.iflockconsulting.com/services-mssp-program) - [Vulnerability Management](https://www.iflockconsulting.com/services-vulnerability-management) - [Compliance & Risk Management](https://www.iflockconsulting.com/services-compliance-risk) - [Professional Services](https://www.iflockconsulting.com/services-professional-services) - [Phishing Campaigns](https://www.iflockconsulting.com/phishing-campaigns/) - [PCI Compliance](https://www.iflockconsulting.com/pci-compliance/) - [Penetration Testing](https://www.iflockconsulting.com/penetration-testing) - Partner Ecosystem - [Industry Partners](https://www.iflockconsulting.com/industry-partners) - [Technology Partners](https://www.iflockconsulting.com/partner-ecosystem) - [Partner Referral Program](https://www.iflockconsulting.com/referral-program) - About Us - [FAQs](https://www.iflockconsulting.com/faq) - [Blog](https://www.iflockconsulting.com/blog) - [Events & Webinars](https://www.iflockconsulting.com/cybersecurity-events-webinars) - [Contact](https://www.iflockconsulting.com/contact-us) # Urgent Security Alert: Critical Flaws in GitLab Require Immediate Action ![Urgent Security Alert: Critical Flaws in GitLab Require Immediate Action](https://www.iflockconsulting.com/hubfs/AdobeStock_443702077.jpeg) - January 17, 2024 ## Urgent Security Breach in GitLab: Immediate Action Required TLP: CLEAR ALERT BULLETIN: DATE: 01/17/2024 ## Briefing A critical security flaw (CVE-2023-7028) has been identified in both the GitLab Community Edition (CE) and Enterprise Edition (EE). In response, GitLab has urgently deployed critical updates in versions 16.7.2, 16.6.4, and 16.5.6. CVE-2023-7028 (rated CVSS 10) is a critical vulnerability allowing unauthorized account access through password reset manipulation. Attackers can potentially seize control of accounts by directing password reset emails to unverified email addresses. This vulnerability impacts the following GitLab versions: - 16.1 to 16.7.1 - Resolved in the subsequent versions: - 16.1.6 - 16.2.9 - 16.3.7 - 16.4.5 - 16.5.6 - 16.6.4 - 16.7.2 A critical vulnerability (CVE-2023-5356, CVSS 9.6) was discovered, involving the misuse of Slack/Mattermost integrations for executing unauthorized slash commands. This issue affects versions 8.13 to 16.7.1, with remedies applied in versions 16.5.6, 16.6.4, and 16.7.2. The active exploitation of CVE-2023-7028 has been observed, but GitLab.com is secure and has been updated to the fixed version. Accounts with two-factor authentication (2FA) are safeguarded against this breach. Users without 2FA should activate it promptly. ## iFlock Security Consulting's Advisory For CVE-2023-7028 and CVE-2023-5356, [GitLab's FAQ](https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/) provides insights on the vulnerabilities' impact, recommended user actions, and confirmation of issue resolution in the latest security release. GitLab also details its future strategies to prevent similar security issues. ## Indicators of Compromise (IoCs) Currently, no IoCs related to CVE-2023-7028 or CVE-2023-5356 have been identified. iFlock Security Consulting is actively monitoring IoCs and will promptly inform customers of any developments. For detailed guidance on safeguarding your organization, contact your iFlock Security Consulting Account Executive. ## iFlock Security Consulting's Protective Measures With the erosion of traditional security perimeters due to expanding endpoints, cloud adoption, and digital transformation, attack surfaces have grown significantly. iFlock Security Consulting offers comprehensive vulnerability management to ensure visibility and control over every threat, device, entry point, and vulnerability. ## Reference Materials - GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 | GitLab - Immediate Action Required: Critical GitLab Flaw Permits Account Takeover (CVE-2023-7028) - Help Net Security - Alert: GitLab Issues Fixes for Critical Security Gaps - Act Now (thehackernews.com) - CVE - CVE-2023-7028 (mitre.org) ## Share This Post [mailto:?body=https://www.iflockconsulting.com/blog/urgent-security-alert-critical-flaws-in-gitlab-require-immediate-action](mailto:?body=https://www.iflockconsulting.com/blog/urgent-security-alert-critical-flaws-in-gitlab-require-immediate-action) ## Subscribe To Our Newsletter ### Get updates and learn from the best [Previous Understanding CVE-2022-39952 and its Impact on Fortinet FortiNAC](https://www.iflockconsulting.com/blog/understanding-cve-2022-39952-and-its-impact-on-fortinet-fortinac) [Next The Benefits of Phishing Awareness: Cybersecurity Education](https://www.iflockconsulting.com/blog/the-benefits-of-phishing-awareness-cybersecurity-education) ## More To Explore [![](https://www.iflockconsulting.com/hubfs/steg-alternate-data-streams.png)](https://www.iflockconsulting.com/blog/imaging-steganography) Blog, Cybersecurity, Cyber Attack, Vulnerability, AI, Training, Ransomware, Data Breach ## [Imaging Steganography and Alternate Data Streams: The New Frontiers of File-Based Threats](https://www.iflockconsulting.com/blog/imaging-steganography) That PNG attachment in your inbox might be more than just pixels. ### Share this: - Twitter - Facebook Karrie Westmoreland October 1, 2025 [![](https://www.iflockconsulting.com/hubfs/ChatGPT%20shield.png)](https://www.iflockconsulting.com/blog/beyond-the-patch) Blog, Cybersecurity, Cyber Attack, Vulnerability, AI, Training, Ransomware, Data Breach ## [Beyond the Patch: Managing Zero-Day Exploitation in Unpatched Environments](https://www.iflockconsulting.com/blog/beyond-the-patch) When Microsoft tells you to unplug your own servers, do not stop, do not pass Go and do not collect $200. Kindly proceed directly to your server room. ### Share this: - Twitter - Facebook Karrie Westmoreland September 15, 2025 [![iFlock Security Consulting](https://www.iflockconsulting.com/hs-fs/hubfs/iflockconsulting%20Favicon%20blue-01-1.png?width=54&height=54&name=iflockconsulting%20Favicon%20blue-01-1.png) iFlockSecurity Consulting](https://www.iflockconsulting.com/) Offensive security testing and compliance for organizations that would rather find the gap first. [1-833-4-HAXORS1-833-442-9677 · talk to a real engineer](tel:18334429677) [info@iflockconsulting.com](mailto:info@iflockconsulting.com) [![iFlock Security Consulting BBB Business Review](https://seal-fortwayne.bbb.org/seals/blue-seal-200-42-bbb-90164698.png)](https://www.bbb.org/us/in/wakarusa/profile/cyber-security/iflock-security-consulting-0352-90164698/#sealclick) #### Services - [Penetration Testing](https://www.iflockconsulting.com/penetration-testing) - [PCI Compliance](https://www.iflockconsulting.com/pci-compliance/) - [Phishing Campaigns](https://www.iflockconsulting.com/phishing-campaigns/) - [All Services](https://www.iflockconsulting.com/services) #### Company - [Blog](https://www.iflockconsulting.com/blog) - [FAQs](https://www.iflockconsulting.com/faq) - [In the News](https://www.iflockconsulting.com/in-the-news) - [Partner With Us](https://www.iflockconsulting.com/partner-with-us) - [Contact](https://www.iflockconsulting.com/contact-us) #### Free Tools - [Spot the Phish](https://www.iflockconsulting.com/spot-the-phish) - [Security Self-Check](https://www.iflockconsulting.com/security-self-check) [Book an assessment](https://www.iflockconsulting.com/free-security-assessment) ©2026 iFlock Security Consulting, LLC. [Privacy & Legal](https://www.iflockconsulting.com/privacy-policy)