Summary
- Environment: Documentation platform and production infrastructure
- Operational impact: Customer data treated as exposed; application outage
- Financial impact: No quantified cost disclosed
- Record status: Developing record. Reviewed November 7, 2026; updated as evidence emerges.
What happened
Impact
GitBook treated all customer data as exposed, although it believed one customer was targeted. Potentially accessible material included API and integration secrets, session-signing secrets, Assistant questions and private documentation; this precaution does not establish that every item was copied. [1]
GitBook excluded billing information, passwords and IP addresses from the affected scope and reported no evidence of modification to other customers’ content. It could not determine actions in customer repositories accessible through authorized integrations. [1]
Disabling compromised service accounts caused an application outage from 20:32 UTC November 2 until 11:56 UTC November 3, with some cached public documentation available. Production access also recurred briefly on November 3. [1]
Timeline
Staff sessions and production infrastructure accessed
An SSO flaw led to staff sessions and then production secrets; containment took the application offline. Source account.
[1]Application restored after credential rotation
The application returned at 11:56 UTC after response work; some production access had also recurred that day. Source account.
[1]Postmortem published
GitBook published the access chain, exposure assessment and customer credential-rotation instructions. Source account.
[1]Briefing updated
This briefing was last reviewed and updated on November 7, 2026.
Threat Group & Attack Vector
An attacker exploited a single-sign-on login flaw to obtain GitBook staff sessions, then accessed GitHub App authentication information, internal code and a Cloudflare API key. The chain exposed production secrets and service-account access. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1190 — Exploit Public-Facing Application. [1]
Response
GitBook fixed the SSO flaw, rotated production and integration keys, invalidated old API tokens and redeployed infrastructure. Customers were instructed to replace API tokens and rotate their own integration secrets and custom authenticated-backend signing keys. [1]