Medium severity6.7NVD Advisory· Published Aug 13, 2025· Updated Jun 17, 2026
CVE-2024-12303
CVE-2024-12303
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 17.7
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=17.7.0,<18.0.6
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=17.7.0,<18.0.6
- (no CPE)range: from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
- Range: from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
- osv-coords19 versionspkg:apk/chainguard/gitlab-docker-machine-18.1pkg:apk/chainguard/gitlab-docker-machine-fips-18.1pkg:apk/chainguard/gitlab-runner-18.1pkg:apk/chainguard/gitlab-runner-fips-18.1pkg:apk/chainguard/gitlab-runner-helper-18.1pkg:apk/chainguard/gitlab-runner-helper-compat-18.1pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.1pkg:apk/chainguard/gitlab-runner-helper-fips-18.1pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.1pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.1pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.1pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.1pkg:apk/wolfi/gitlab-docker-machine-18.1pkg:apk/wolfi/gitlab-runner-18.1pkg:apk/wolfi/gitlab-runner-helper-18.1pkg:apk/wolfi/gitlab-runner-helper-compat-18.1pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.1pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.1pkg:bitnami/gitlab
< 18.1.3-r1+ 18 more
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r3
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: < 18.1.3-r1
- (no CPE)range: >= 17.7.0, < 18.0.6
Patches
Vulnerability mechanics
References
2- gitlab.com/gitlab-org/gitlab/-/issues/508298nvdBroken Link
- hackerone.com/reports/2861889nvdPermissions Required
News mentions
1- GitLab Patch Release: 18.2.2, 18.1.4, 18.0.6GitLab Security Releases · Aug 13, 2025