CVE-2024-1539

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-1539
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1539.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-1539
Aliases
Published
2025-02-05T09:46:46.182Z
Modified
2026-04-10T05:07:31.870232Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Missing Authorization in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1539.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
d836c22d87f6f0397b93cc72ce3af27a6dc02d93
Fixed
6878f253b7b50c8e6217ebfd03717b5e5ea960a4
Database specific 
{
    "versions": [
        {
            "introduced": "15.2"
        },
        {
            "fixed": "16.9.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
053df647320e7cac5c255f9e07264a0c35548409
Fixed
f5974fc8f24e7033135f5b0d4f77b68886b2e298
Database specific 
{
    "versions": [
        {
            "introduced": "16.10"
        },
        {
            "fixed": "16.10.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
22834294718a25956b0a859c8eed72248300eeee
Fixed
d210b947e3e51eebcbb24a9152f5c68f7e2b1d58
Database specific 
{
    "versions": [
        {
            "introduced": "16.11"
        },
        {
            "fixed": "16.11.2"
        }
    ]
}

Affected versions

v16.*
v16.10.0-ee
v16.10.3-ee
v16.11.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1539.json"