VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Feb 8, 2024· Updated Jun 17, 2026

CVE-2023-6564

CVE-2023-6564

Description

An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

Affected products

8
  • GitLab Inc./GitLabv55 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.4.3
    • cpe:2.3:a:gitlab:gitlab:16.4.3:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:gitlab:gitlab:16.5.3:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:gitlab:gitlab:16.6.1:*:*:*:enterprise:*:*:*
    • (no CPE)range: 16.4.3, 16.5.3, and 16.6.1
  • GitLab Inc./GitLab EE Premiumllm-create
    Range: 16.4.3, 16.5.3, and 16.6.1
  • GitLab Inc./GitLab EE Ultimatellm-create
    Range: 16.4.3, 16.5.3, and 16.6.1
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 16.4.3, < 16.4.4

Patches

Vulnerability mechanics

References

1

News mentions

1