CVE-2023-3979

LOW

GitLab 10.6-16.2.7, 16.3-16.3.4, 16.4 - Incorrect Authorization in Merge Request Source Branch

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch.

References (2)

Core 2
Core References
Broken Link issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/419972
Permissions Required technical-description exploit permissions-required
https://hackerone.com/reports/2082560

Scores

CVSS v3 3.1
EPSS 0.0006
EPSS Percentile 18.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (5)
gitlab/gitlab 16.4.0 (2 CPE variants)
gitlab/gitlab 10.6 - 16.2.8 (2 CPE variants)
GitLab/GitLab 10.6 - 16.2.8
GitLab/GitLab 16.3 - 16.3.5
GitLab/GitLab 16.4 - 16.4.1
Published Sep 29, 2023
Tracked Since Feb 18, 2026