CVE-2024-1539

MEDIUM

GitLab 15.2-16.9.6, 16.10-16.10.4, 16.11-16.11.1 - Missing Authorization for Banned Group Member Issue Update Disclosure

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.

References (2)

Core 2
Core References
Broken Link issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/442049
Permissions Required technical-description exploit permissions-required
https://hackerone.com/reports/2369988

Scores

CVSS v3 4.3
EPSS 0.0004
EPSS Percentile 13.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
gitlab/gitlab 15.2.0 - 16.9.7
Published Feb 05, 2025
Tracked Since Feb 18, 2026