CVE-2024-7296 - Incorrect Authorization in GitLab

Back Back to CVE browser

LOW

Incorrect Authorization in GitLab

Published Mar 13, 2025

2.7

LOW

CVSS 3.1

EPSS 0.36%

Description

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  16.5
  Status
  affected
  Constraints
  <17.7.7
- Version
  17.8
  Status
  affected
  Constraints
  <17.8.5
- Version
  17.9
  Status
  affected
  Constraints
  <17.9.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
16.5	affected	<17.7.7
17.8	affected	<17.8.5
17.9	affected	<17.9.2

Remediation

Vendor solution

Upgrade to versions 17.7.7, 17.8.5, 17.9.2 or above.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://gitlab.com/gitlab-org/gitlab/-/issues/475056
issue-trackingpermissions-requiredExploitIssue Tracking
https://hackerone.com/reports/2602274
technical-descriptionexploitpermissions-requiredPermissions Required

Link	Providers	Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/475056		issue-trackingpermissions-requiredExploitIssue Tracking
https://hackerone.com/reports/2602274		technical-descriptionexploitpermissions-requiredPermissions Required