GitLab EUVD-2026-107677

Exploitation requires that BOTH OmniAuth SAML authentication AND LDAP auto-linking are enabled on the GitLab instance - a specific, non-default combination; instances without both features configured are not affected. The attacker must be an authenticated GitLab user (PR:L), but no interaction from the targeted victim is needed (UI:N), and the account takeover affects any existing LDAP-backed account. The AC:H rating indicates meaningful attacker effort or conditions beyond pure default exploitation. Limiting factors for defenders: the dual-feature prerequisite sharply narrows the vulnerable population, authentication is required, and only instances on affected versions below 19.3.6 / 19.4.3 / 19.5.1 are in scope.

This is a credible, above-average priority for organizations running GitLab with the specific affected configuration, but it is not a drop-everything emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, score 8.2) shows a network-reachable flaw requiring only low privileges (any authenticated user) and no victim interaction, yielding high confidentiality and integrity impact with a scope change - consistent with full takeover of another user's LDAP-backed account. The AC:H rating is the key tempering signal: successful exploitation is non-trivial and hinges on a precise condition (both OmniAuth SAML and LDAP auto-linking enabled). Publicly available exploit code exists (referenced HackerOne report #3852192), which raises practical risk, but this is distinct from active exploitation: there is no CISA KEV listing and no EPSS score in the provided data, so real-world exploitation volume cannot be quantified from these inputs. No SSVC decision record was provided. Net: treat as high-severity for environments matching the vulnerable config, moderate elsewhere, with the non-default dual-feature requirement and AC:H meaningfully narrowing the exposed population versus the raw 8.2 score. EPSS and KEV data are both absent and should be checked directly before final prioritization.

In a GitLab instance where both OmniAuth SAML and LDAP auto-linking are enabled, a low-privileged authenticated attacker initiates OmniAuth identity linking and supplies crafted input that is passed unsanitized into the LDAP email lookup query. Because of the improper input neutralization (CWE-90), the lookup resolves to a targeted victim's LDAP-backed account and links the attacker's identity to it, resulting in takeover with no interaction from the victim. Public exploit code for this flow is available via the referenced HackerOne report.