Medium severity6.5NVD Advisory· Published Nov 26, 2024· Updated Jun 17, 2026
CVE-2024-11669
CVE-2024-11669
Description
An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.
Affected products
17- osv-coords10 versionspkg:apk/chainguard/gitlab-runner-17.6pkg:apk/chainguard/gitlab-runner-helper-compat-17.6pkg:apk/chainguard/gitlab-runner-helper-17.6pkg:apk/chainguard/gitlab-runner-oci-entrypoint-17.6pkg:apk/chainguard/gitlab-runner-helper-fips-17.6pkg:apk/chainguard/gitlab-docker-machine-17.6pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-17.6pkg:bitnami/gitlabpkg:apk/chainguard/gitlab-runner-fips-17.6pkg:apk/chainguard/gitlab-docker-machine-fips-17.6
< 17.6.1-r0+ 9 more
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: >= 16.9.8, < 17.4.5
- (no CPE)range: < 17.6.1-r0
- (no CPE)range: < 17.6.1-r0
cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.9.8
- (no CPE)range: 16.9.8 - 17.4.4, 17.5 - 17.5.2, 17.6 - 17.6.0
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=16.9.8,<17.4.5
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=16.9.8,<17.4.5
- cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:community:*:*:*
- cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:enterprise:*:*:*
- Range: 16.9.8 - 17.4.4, 17.5 - 17.5.2, 17.6 - 17.6.0
Patches
Vulnerability mechanics
References
1- gitlab.com/gitlab-org/gitlab/-/issues/501528nvdBroken Link
News mentions
1- GitLab Patch Release: 17.6.1, 17.5.3, 17.4.5GitLab Security Releases · Nov 26, 2024