Unintended Role-Based Access Control Vulnerability in GitLab EE
CVE-2024-0861
4.3MEDIUM
Summary
An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.
Affected Version(s)
GitLab < 16.9.1
GitLab < 16.8.3
GitLab < 16.7.6
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published.
Vulnerability Reserved.
Collectors
NVD DatabaseMitre Database
Credit
Thanks [them4les_l1r](https://hackerone.com/them4les_l1r) for reporting this vulnerability through our HackerOne bug bounty program