GitLab Patches an Auto-Linking Account Takeover and a Poisoned Discovery Map. Both Trusted Input Nobody Checked.

GitLab shipped a critical patch release on October 21, 2026, fixing 12 security vulnerabilities across its Community and Enterprise editions. It covers versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, detailed on the patch release page . Two identity bugs lead the advisory: CVE-2026-15723 and CVE-2026-112212. Both trusted input nobody checked. Identity linking and cache poisoning CVE-2026-15723 is high severity, CVSS 8.2, and affects GitLab CE and EE from 10.1 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. The advisory states: “GitLab has remediated an issue that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth…

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.