GitBook says in a post-mortem dated 4 November 2026 that on 2 November an attacker gained unauthorised access to its systems by using a flaw in its SSO login flow to create login sessions acting as GitBook staff.

It says this let the attacker query the authentication information of a misconfigured GitHub App installed in its organisation, reach its internal code repositories and then a Cloudflare API key, which gave access to production secrets and full infrastructure access through a service account.

GitBook says the attacker had access to production for about 2 hours 45 minutes on the evening of 2 November and about 40 minutes early on 3 November; it disabled the affected service accounts, which took the app offline from 20:32 UTC on 2 November to 11:56 UTC on 3 November (about 16 hours), rotated every infrastructure secret and every GitBook-managed customer secret, and invalidated all API tokens issued before its cutoff.

It says the attack appears aimed at one customer and it found no evidence any other customer's content was modified, but it treats all customer data as exposed, including content and the ability to act as its GitHub and GitLab apps in repositories customers had granted; it says billing information, passwords and IP addresses were not compromised, and it has published attacker IP addresses. (source: GitBook)