What’s Vulnerable › Vulnerabilities
CVE-2017-0919
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-07-03 · updated 2026-06-17
- Weakness: CWE-306
Description
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.
Affected products
- GitLab: before 10.1.6; from 10.2.0 before 10.2.6; from 10.3.0 before 10.3.4 — fixed in 10.1.6, 10.2.6, 10.3.4
How to fix
Upgrade to a fixed version: GitLab 10.1.6, 10.2.6, 10.3.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2017-0919 or the next vulnerability affects your stack