CVE-2023-6564: Incorrect Authorization in GitLab

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-08 · updated 2026-06-17
Weakness: CWE-863

Description

An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

Affected products

GitLab: 16.4.3, 16.5.3, 16.6.1

References

https://gitlab.com/gitlab-com/gl-infra/production/-/issues/17213
https://gitlab.com/gitlab-com/gl-infra/production/-/issues/17213

Get alerted when CVE-2023-6564 or the next vulnerability affects your stack