{"id":"CVE-2024-0456","state":"PUBLISHED","title":"Direct Request ('Forced Browsing') in GitLab","description":"An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project","publishedAt":"2024-01-26T01:02:43.953Z","updatedAt":"2026-06-15T22:59:52.879Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThan":"16.6.6","versionType":"semver"},{"version":"16.7","status":"affected","lessThan":"16.7.4","versionType":"semver"},{"version":"16.8","status":"affected","lessThan":"16.8.1","versionType":"semver"}],"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git"}],"references":["https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/","https://gitlab.com/gitlab-org/gitlab/-/issues/430726"],"weaknesses":["CWE-425"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/0xxx/CVE-2024-0456.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-0456","state":"PUBLISHED","datePublished":"2024-01-26T01:02:43.953Z","dateUpdated":"2026-06-15T22:59:52.879Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2024-01-12T08:02:33.279Z"},"containers":{"cna":{"title":"Direct Request ('Forced Browsing') in GitLab","descriptions":[{"lang":"en","value":"An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project"}],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"14.0","status":"affected","lessThan":"16.6.6","versionType":"semver"},{"version":"16.7","status":"affected","lessThan":"16.7.4","versionType":"semver"},{"version":"16.8","status":"affected","lessThan":"16.8.1","versionType":"semver"}],"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git"}],"references":[{"url":"https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/"},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/430726","name":"GitLab Issue #430726","tags":["issue-tracking"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-425","description":"CWE-425: Direct Request ('Forced Browsing')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2026-06-15T22:59:52.879Z"},"credits":[{"lang":"en","type":"finder","value":"Thanks to [Niklas](https://gitlab.com/Taucher2003) for reporting this vulnerability"}],"solutions":[{"lang":"en","value":"Upgrade to versions 16.8.1, 16.7.4, 16.6.6 or above"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/","tags":["x_transferred"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/430726","name":"GitLab Issue #430726","tags":["issue-tracking","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:04:49.813Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-08T15:52:46.854334Z","id":"CVE-2024-0456","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-29T15:17:26.228Z"}}]}}}