CVE-2023-3443

LOW

GitLab 12.1-16.4.2 16.5-16.5.2 16.6 - Incorrect Authorization for Emoji Addition on Confidential Work Items

Title source: llm

Description

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.

References (2)

Core 2

Core References

Broken Link, Vendor Advisory issue-tracking

https://gitlab.com/gitlab-org/gitlab/-/issues/416497

Permissions Required, Third Party Advisory technical-description exploit permissions-required

https://hackerone.com/reports/2036500

Scores

CVSS v3 3.1

EPSS 0.0006

EPSS Percentile 17.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-863

Status published

Products (2)

gitlab/gitlab 16.6.0 (2 CPE variants)

gitlab/gitlab 12.1.0 - 16.4.3 (2 CPE variants)

Published Dec 01, 2023

Tracked Since Feb 18, 2026