GitLab’s LDAP email lookup path does not properly neutralize special characters in LDAP queries, allowing an authenticated user to inject LDAP syntax. The injection can be used to link an attacker’s authenticated identity to an existing LDAP-backed account belonging to another user, effectively taking over that account without the target’s interaction. This flaw is classified as CWE‑90 and can enable an attacker to gain unauthorized access to protected resources and user data.

The vulnerability affects GitLab Community Edition and Enterprise Edition. All versions from 10.1 up to but excluding 19.3.6, all 19.4 releases before 19.4.3, and all 19.5 releases before 19.5.1 are impacted. The affected configurations require both OmniAuth SAML and LDAP auto‑linking to be enabled.

The CVSS score of 8.2 indicates high severity, and the absence of an EPSS score suggests a lack of publicly available exploit data. The flaw is not listed in CISA’s KEV catalog, but it can be exploited in environments where an attacker possesses valid authentication credentials and where the specified authentication flows are active. Given the need for an authenticated user, the attack vector is likely internal or represents a compromised credential scenario. Once exploited, the attacker can impersonate any user with LDAP‑backed identities, potentially accessing privileged functionality and sensitive data.