CVE-2024-0456

MEDIUM

GitLab <14.0-16.8.1 - Auth Bypass

Title source: llm

Description

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

References (2)

[Vendor Advisory] https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/

[Broken Link] https://gitlab.com/gitlab-org/gitlab/-/issues/430726

Scores

CVSS v3 4.3

EPSS 0.0010

EPSS Percentile 27.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-425

Status published

Affected Products (4)

gitlab/gitlab < 16.6.6

gitlab/gitlab

Timeline

Published Jan 26, 2024

Tracked Since Feb 18, 2026