🔐 CVE Alert

CVE-2024-0456

MEDIUM 4.3

Direct Request ('Forced Browsing') in GitLab

CVSS Score
4.3
EPSS Score
0.1%
EPSS Percentile
23th

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

CWE CWE-425
Vendor gitlab
Product gitlab
Ecosystems
Industries
Technology
Published Jan 26, 2024
Last Updated Apr 16, 2026
Stay Ahead of the Next One

Get instant alerts for gitlab gitlab

Be the first to know when new medium vulnerabilities affecting gitlab gitlab are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected Versions

GitLab / GitLab
14.0 < 16.6.6 16.7 < 16.7.4 16.8 < 16.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
about.gitlab.com: https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ gitlab.com: https://gitlab.com/gitlab-org/gitlab/-/issues/430726

Credits

Thanks to [Niklas](https://gitlab.com/Taucher2003) for reporting this vulnerability