High [CVE-2023-3932 +1] Incorrect Authorization in GitLab
This high-severity GitLab advisory covers CVE-2023-5009 and CVE-2023-3932 affecting GitLab.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 2 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.
VulniPulse record published
Get an email when GitLab publishes the next one.
VulniPulse checks GitLab's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.
This was a bypass of CVE-2023-3932 showing additional impact.
- GitLab 13.12 before 16.2.7
- GitLab 16.3 before 16.3.4
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
- 16.2.7
- 16.3.4
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
Mitigation
Upgrade to a fixed release: 16.2.7, 16.3.4. That is the remediation for this advisory.
The vendor advisory may list interim mitigations or workarounds not captured here. Review it before change work.
Official advisory · high-confidence parse· fetched 2 days ago·verify at source
More GitLab advisories
- CVE-2026-110264Oct 22, 2026issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13
- CVE-2026-12664Oct 21, 2026GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before
- CVE-2026-13319Oct 21, 2026GitLab improper access control
- CVE-2026-14288Oct 21, 2026GitLab improper access control
- CVE-2026-15723Oct 21, 2026GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before
- CVE-2026-16255Oct 21, 2026GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before
Android app · Google Play
Monitor future GitLab CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.