CVE-2024-0861

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-0861
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0861.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-0861
Aliases
Downstream
Published
2024-02-21T23:30:39.942Z
Modified
2025-12-05T04:01:46.550241Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Direct Request ('Forced Browsing') in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the Guest role can change Custom dashboard projects settings contrary to permissions.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0861.json",
    "cwe_ids": [
        "CWE-425"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
76326ae8b898b38c8217ad037ed7122be00e62f0
Fixed
cc62007c12dc634c7442a9b1dc94508e50e5dba5
Database specific 
{
    "versions": [
        {
            "introduced": "16.9"
        },
        {
            "fixed": "16.9.1"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1e912d57d5a8f1135f4d41e25469069790134d41
Fixed
39213e8fab4a70aa7cf64bb1c75012bb11fd7b15
Database specific 
{
    "versions": [
        {
            "introduced": "16.8"
        },
        {
            "fixed": "16.8.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e4c1c182610739c1b1d10a8eacbea1f5aa837ad6
Fixed
c8f3448a2f0cfb3c812fc4619e0f16bc3feb133b
Database specific 
{
    "versions": [
        {
            "introduced": "16.4"
        },
        {
            "fixed": "16.7.6"
        }
    ]
}

Affected versions

v16.*

v16.8.0-ee
v16.8.1-ee
v16.8.2-ee
v16.9.0-ee
v16.9.0-rc44-ee