CVE-2023-6840

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-6840
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6840.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6840
Aliases
Downstream
Published
2024-02-07T22:02:20.934Z
Modified
2025-12-05T04:00:23.339904Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H CVSS Calculator
Summary
Missing Authorization in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6840.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e4c1c182610739c1b1d10a8eacbea1f5aa837ad6
Fixed
df35a584380b571e113908bcd4d13e28a002aa09
Database specific 
{
    "versions": [
        {
            "introduced": "16.4"
        },
        {
            "fixed": "16.6.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
9e7d34f7ff11405ece06ec398b66965d153cee6f
Fixed
7f8d8e1af0b21cfdf58a4d00d5edb2c08dcfbc16
Database specific 
{
    "versions": [
        {
            "introduced": "16.7"
        },
        {
            "fixed": "16.7.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1e912d57d5a8f1135f4d41e25469069790134d41
Fixed
e3c23d67e9ce2f074cd79b753ef95291da459a93
Database specific 
{
    "versions": [
        {
            "introduced": "16.8"
        },
        {
            "fixed": "16.8.2"
        }
    ]
}

Affected versions

v16.*

v16.7.0-ee
v16.7.2-ee
v16.7.3-ee
v16.7.4-ee
v16.8.0-ee
v16.8.1-ee