CVE-2023-3907

Improper User Management in GitLab

View on CVE.org

Published Dec 17, 2023 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Description

A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

GitLab

GitLab

unaffected

Version	Status	Constraints
`16.0`	affected	< 16.4.4
`16.5`	affected	< 16.5.4
`16.6`	affected	< 16.6.2

Configuration 1 [-]

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

No data.

No data available yet.

Remediation

Vendor Solution

Upgrade to version 16.4.4, 16.5.4 or 16.6.2

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-44533	A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.683% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://gitlab.com/gitlab-org/gitlab/-/issues/418878
https://hackerone.com/reports/2058934

History

Oct 8, 2024 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-269	NVD-CWE-Other

Oct 3, 2024 6:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Improper Privilege Management in GitLab	Improper User Management in GitLab
Weaknesses		CWE-286

Sep 19, 2024 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 29, 2024 3:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:gitlab:gitlab::::::::

Subscriptions

Gitlab Gitlab

Weaknesses

Sources

CVE record Updated: May 31, 2026, 4:05 AM

Status: PUBLISHED
Assigner: GitLab
Published: Dec 17, 2023, 11:02 PM
Updated: May 31, 2026, 4:05 AM
Reserved: Jul 25, 2023, 10:30 AM

View source JSON

Vulnrichment Updated: Aug 2, 2024, 7:08 AM

Updated: Aug 2, 2024, 7:08 AM

NVD Updated: Jun 17, 2026, 6:15 AM

Status: Analyzed
Published: Dec 17, 2023, 11:15 PM
Modified: Jun 17, 2026, 6:15 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-3907", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2023-07-25T10:30:28.613Z", "datePublished": "2023-12-17T23:02:36.694Z", "dateUpdated": "2026-05-31T04:05:00.429Z"}, "containers": {"cna": {"title": "Improper User Management in GitLab", "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner"}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "16.0", "status": "affected", "lessThan": "16.4.4", "versionType": "semver"}, {"version": "16.5", "status": "affected", "lessThan": "16.5.4", "versionType": "semver"}, {"version": "16.6", "status": "affected", "lessThan": "16.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-286: Incorrect User Management", "cweId": "CWE-286", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418878", "name": "GitLab Issue #418878", "tags": ["issue-tracking"]}, {"url": "https://hackerone.com/reports/2058934", "name": "HackerOne Bug Bounty Report #2058934", "tags": ["technical-description", "exploit", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 16.4.4, 16.5.4 or 16.6.2"}], "credits": [{"lang": "en", "value": "Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-05-31T04:05:00.429Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:08:50.859Z"}, "title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418878", "name": "GitLab Issue #418878", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://hackerone.com/reports/2058934", "name": "HackerOne Bug Bounty Report #2058934", "tags": ["technical-description", "exploit", "x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-27T15:56:10.049753Z", "id": "CVE-2023-3907", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T15:56:17.681Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418878", "name": "GitLab Issue #418878", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://hackerone.com/reports/2058934", "name": "HackerOne Bug Bounty Report #2058934", "tags": ["technical-description", "exploit", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:08:50.859Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-3907", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-27T15:56:10.049753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T15:56:14.168Z"}}], "cna": {"title": "Improper User Management in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "16.0", "lessThan": "16.4.4", "versionType": "semver"}, {"status": "affected", "version": "16.5", "lessThan": "16.5.4", "versionType": "semver"}, {"status": "affected", "version": "16.6", "lessThan": "16.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 16.4.4, 16.5.4 or 16.6.2"}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418878", "name": "GitLab Issue #418878", "tags": ["issue-tracking"]}, {"url": "https://hackerone.com/reports/2058934", "name": "HackerOne Bug Bounty Report #2058934", "tags": ["technical-description", "exploit", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-286", "description": "CWE-286: Incorrect User Management"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-05-31T04:05:00.429Z"}}}, "cveMetadata": {"cveId": "CVE-2023-3907", "state": "PUBLISHED", "dateUpdated": "2026-05-31T04:05:00.429Z", "dateReserved": "2023-07-25T10:30:28.613Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2023-12-17T23:02:36.694Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "16.4.4", "status": "affected", "version": "16.0", "versionType": "semver"}, {"lessThan": "16.5.4", "status": "affected", "version": "16.5", "versionType": "semver"}, {"lessThan": "16.6.2", "status": "affected", "version": "16.6", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "00377DD9-D454-4084-9D94-D48C8F1E11C5", "versionEndExcluding": "16.4.4", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "B9D88266-872E-4BD9-B3DF-D1C540E66AFD", "versionEndExcluding": "16.5.4", "versionStartIncluding": "16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "D5C45787-C8C9-432E-8DAF-6F5264BBE0B3", "versionEndExcluding": "16.6.2", "versionStartIncluding": "16.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner"}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios en GitLab EE que afecta a todas las versiones desde 16.0 anterior a 16.4.4, 16.5 anterior a 16.5.4 y 16.6 anterior a 16.6.2 permite que un mantenedor de proyecto use un token de acceso al proyecto para escalar su rol a propietario."}], "id": "CVE-2023-3907", "lastModified": "2026-06-17T06:15:18.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-3907", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-27T15:56:10.049753Z", "version": "2.0.3"}}]}, "published": "2023-12-17T23:15:43.937", "references": [{"source": "cve@gitlab.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418878"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2058934"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418878"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2058934"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-286"}], "source": "cve@gitlab.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}