CVE-2024-12303

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12303
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12303.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-12303
Aliases
Downstream
Related
Published
2025-08-13T17:27:45.555Z
Modified
2026-02-05T05:31:51.073771Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Incorrect Privilege Assignment in GitLab
Details

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.

Database specific 
{
    "cwe_ids": [
        "CWE-266"
    ],
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12303.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1fd574ee5710155adf5307fba45132264dcb64a1
Fixed
85327bfea0841b1eda70dc49b76918681510f967
Database specific 
{
    "versions": [
        {
            "introduced": "17.7"
        },
        {
            "fixed": "18.0.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e0f3b86408aa4e7f03b63ac9e7dba6de1df14e93
Fixed
693bb5e6ca55d16970747e6a3157ab801608b758
Database specific 
{
    "versions": [
        {
            "introduced": "18.1"
        },
        {
            "fixed": "18.1.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
64403a0daee4413eb45b939590f37c351b8e72bf
Fixed
bef324d0853760755341c3ea7ca9469e4d962377
Database specific 
{
    "versions": [
        {
            "introduced": "18.2"
        },
        {
            "fixed": "18.2.2"
        }
    ]
}

Affected versions

v18.*
v18.1.0-ee
v18.1.1-ee
v18.1.2-ee
v18.1.3-ee
v18.2.0-ee
v18.2.1-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12303.json"