What’s Vulnerable › Vulnerabilities

CVE-2023-6477: Incorrect Privilege Assignment in GitLab

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-22 · updated 2026-06-17
• Weakness: CWE-266

Description

An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation.

Affected products

• GitLab: from 16.5.0 before 16.7.6; from 16.8.0 through 16.8.3; 16.9.0 — fixed in 16.7.6

How to fix

Upgrade to a fixed version: GitLab 16.7.6. Check the vendor advisory for mitigations.

References

• https://gitlab.com/gitlab-org/gitlab/-/issues/433463
• https://hackerone.com/reports/2270898
• https://gitlab.com/gitlab-org/gitlab/-/issues/433463
• https://hackerone.com/reports/2270898

Get alerted when CVE-2023-6477 or the next vulnerability affects your stack