CVE-2024-0410

HIGH

GitLab <16.7.6-16.9.1 - Auth Bypass

Title source: llm

Description

An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

References (2)

[Permissions Required] https://gitlab.com/gitlab-org/gitlab/-/issues/437988

[Permissions Required] https://hackerone.com/reports/2296778

Scores

CVSS v3 7.7

EPSS 0.0001

EPSS Percentile 1.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Classification

CWE

CWE-841

Status published

Affected Products (2)

gitlab/gitlab < 16.7.6

gitlab/gitlab

Timeline

Published Feb 22, 2024

Tracked Since Feb 18, 2026