CVE-2023-4812

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-4812
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4812.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-4812
Aliases
Downstream
Published
2024-01-12T13:56:56.701Z
Modified
2025-12-05T01:04:48.209552Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4812.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
b189ba070558de141d90142340de25bd3edcbefc
Fixed
328c57b01842700127bb3d1302f5b5b967fa4442
Database specific 
{
    "versions": [
        {
            "introduced": "15.3"
        },
        {
            "fixed": "16.5.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
94991886af3e3820aa09fa353b29cf8557c93168
Fixed
1873157df5a1e602741dc5fbe790db81888baea4
Database specific 
{
    "versions": [
        {
            "introduced": "16.6"
        },
        {
            "fixed": "16.6.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
9e7d34f7ff11405ece06ec398b66965d153cee6f
Fixed
847f5d82ad6aa1208a61fee603fc0e0ce1786f19
Database specific 
{
    "versions": [
        {
            "introduced": "16.7"
        },
        {
            "fixed": "16.7.2"
        }
    ]
}

Affected versions

v16.*

v16.6.0-ee
v16.6.1-ee
v16.6.2-ee
v16.7.0-ee

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4812.json"