CVE-2024-7296

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-7296
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7296.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-7296
Aliases
Published
2025-03-13T06:00:54.415Z
Modified
2026-04-10T05:19:35.195855Z
Severity
  • 2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7296.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
fc87c9d4cca1536abcf902b4128f5c2004d87162
Fixed
14925e89dd8fcbadc4624ab451d64238cc651365
Database specific 
{
    "versions": [
        {
            "introduced": "16.5"
        },
        {
            "fixed": "17.7.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f03594b9e09b648c839e9c008286a24c93c82373
Fixed
d7f0517433cc803ed10f8fed5b6b667d66f7a296
Database specific 
{
    "versions": [
        {
            "introduced": "17.8"
        },
        {
            "fixed": "17.8.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f5041566b342c2f30a8d63b8117272c454e18410
Fixed
56dedd4cf9e7ce144b36c34ed45aa57355859659
Database specific 
{
    "versions": [
        {
            "introduced": "17.9"
        },
        {
            "fixed": "17.9.2"
        }
    ]
}

Affected versions

v17.*
v17.8.0-ee
v17.8.3-ee
v17.9.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7296.json"