Threats tagged 'bit-gitlab-2026-15723'

GitLab versions from 10.1 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 contain an LDAP injection vulnerability. This flaw occurs when OmniAuth SAML and LDAP auto-linking are both enabled, allowing an authenticated user to take over an existing LDAP-backed account without interaction from the targeted user due to improper input sanitization in the LDAP email lookup during OmniAuth identity linking. The issue has been fixed in GitLab versions 19.3.6, 19.4.3, and 19.5.1.