CVE-2023-5207
Execution with Unnecessary Privileges in GitLab
- State
- Published
- Severity
- 8.2 High
- Published
- Sep 30, 2023
- Updated
- Aug 14, 2026
- Reserved
- Sep 26, 2023
Description
A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N | GitLab |
Weaknesses
- CWE-250 Execution with Unnecessary Privileges
Affected Products
| Product | Versions |
|---|---|
GitLabGitLab |
|
References
- GitLab Issue #425604issue-tracking
- GitLab Issue #425857issue-trackingpermissions-required
- HackerOne Bug Bounty Report #2174141technical-descriptionexploitpermissions-requiredbroken-link
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.