Authentication Bypass in GitLab CE/EE by User Manipulation
CVE-2024-9183

7.7HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
5 December 2025

What is CVE-2024-9183?

GitLab has resolved a significant issue that impacted GitLab CE/EE across multiple versions. The vulnerability enabled an authenticated user to exploit specific conditions to access credentials belonging to higher-privileged users. This flaw could allow unauthorized actions to be performed under the context of those more privileged accounts, thereby compromising user security and system integrity. Users are encouraged to upgrade to the latest versions to mitigate these risks.

Affected Version(s)

GitLab 18.4 < 18.4.5

GitLab 18.5 < 18.5.3

GitLab 18.6 < 18.6.1

References

https://about.gitlab.com/releases/2025/11/26/patch-releas...
vendor-advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/494478
issue-trackingpermissions-required
https://hackerone.com/reports/2707421
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [aphantom](https://hackerone.com/aphantom) for reporting this vulnerability through our HackerOne bug bounty program
JSON
.