CVE-2023-5356 is a high severity (CVSS 7.3) incorrect authorization flaw in GitLab CE and EE. It lets a user abuse the Slack or Mattermost integrations to run slash commands as another user. It is fixed in 16.5.6, 16.6.4 and 16.7.2, so upgrade to one of those or later.
What's affected
The NVD record gives these affected ranges: all versions from 8.13 before 16.5.6, from 16.6 before 16.6.4, and from 16.7 before 16.7.2. So the fixed releases are 16.5.6, 16.6.4 and 16.7.2, each for its own release line, and anything newer.
The record says incorrect authorization checks allow a user to abuse the Slack or Mattermost integrations to run slash commands as another user. The public GitLab issue is a HackerOne report that shows the report was filed on 1 October 2023. We do not repeat its details here.
Self managed GitLab is affected. If you use GitLab.com, GitLab operates the fix for you, but self hosted installs must be upgraded by their administrators.
How to check if you're exposed
Find your version in the Admin Area, on the Help page, or on the command line of an Omnibus install.
sudo gitlab-rake gitlab:env:info
Then check whether the Slack slash commands or Mattermost slash commands integrations are enabled in any project or at the instance level. If none are in use, the exposure is smaller, though you should still upgrade.
Review who can configure these integrations, and look at the audit events for recent changes to them.
What to do now
- Upgrade self managed GitLab to 16.5.6, 16.6.4, 16.7.2 or any later release.
- Review which projects use Slack or Mattermost slash command integrations.
- Disable integrations you do not use.
- Limit who can configure project integrations to maintainers.
- Review CI job and ChatOps activity for runs started in the name of users who did not request them.
Why it matters
The weakness is CWE-863, incorrect authorization. The integration trusts a request enough to act as a named GitLab user, without checking that the sender is that user. Commands then run with that user rights, which can include starting ChatOps jobs.
ChatOps links chat to pipelines, so a flaw in the link can reach build and deploy steps. That makes authorization checks in integrations worth a close look. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Do I need to patch if I do not use Slack or Mattermost integrations?
The risk is tied to those integrations, but patching is still the right move, because GitLab release lines contain many other fixes and the upgrade is routine.
Sources
Last reviewed: 19 October 2026.
