CVE-2023-5612
Missing Authorization in GitLab
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jan 26, 2024
- Updated
- Aug 14, 2026
- Reserved
- Oct 17, 2023
Description
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | GitLab |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
GitLabGitLab |
|
References
- https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/
- GitLab Issue #428441issue-trackingpermissions-required
- HackerOne Bug Bounty Report #2208790technical-descriptionexploitpermissions-requiredbroken-link
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.