VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jan 26, 2024· Updated Jun 17, 2026

CVE-2024-0456

CVE-2024-0456

Description

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • GitLab Inc./GitLabv56 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 14.0
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=14.0.0,<16.6.6
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=14.0.0,<16.6.6
    • cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:community:*:*:*
    • cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:enterprise:*:*:*
    • (no CPE)range: <16.6.6, <16.7.4, <16.8.1
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 14.0.0, < 16.6.6

Patches

Vulnerability mechanics

References

2

News mentions

1