CVE-2023-3932
Incorrect User Management in GitLab
CVE-2023-3932: Incorrect User Management in GitLab. Not in the CISA KEV catalog. High advisory severity (CVSS 8.2, GitLab). Fixed in 16.0.8, 16.1.3 (GitLab).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when GitLab publishes the next one.
VulniPulse checks GitLab's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2023-3932 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- CVSS base score
- 8.2 (GitLab)
- Fixed releases
- GitLab: 16.0.8, 16.1.3, 16.2.2
- Vendor advisories
- 2 from GitLab
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2023-3932; bulletin-wide values are not repeated here.
Is CVE-2023-3932 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2023-3932 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2023-3932?
Upgrade to a fixed release named by the vendor:
- GitLab: 16.0.8, 16.1.3, 16.2.2
Vendor advisory comparison
GitLab
2 advisories- Advisory severityHigh8.2
High [CVE-2023-3932 +1] Incorrect Authorization in GitLab
CVE-2023-5009Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of CVE-2023-3932 showing additional impact.
- Affected products in this advisory
- GitLab
- Source-reported affected versions
- GitLab 13.12 before 16.2.7
- GitLab 16.3 before 16.3.4
- Source-reported fixed versions
- 16.2.7
- 16.3.4
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Advisory severityHigh8.2
High [CVE-2023-3932] Incorrect User Management in GitLab
CVE-2023-3932Source published Source updated
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.
- Affected products in this advisory
- GitLab
- Source-reported affected versions
- GitLab 13.12 before 16.0.8
- GitLab 16.1.0 before 16.1.3
- GitLab 16.2.0 before 16.2.2
- Source-reported fixed versions
- 16.0.8
- 16.1.3
- 16.2.2
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
More GitLab advisories
- CVE-2026-110264Oct 22, 2026issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13
- CVE-2026-12664Oct 21, 2026GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before
- CVE-2026-13319Oct 21, 2026GitLab improper access control
- CVE-2026-14288Oct 21, 2026GitLab improper access control
- CVE-2026-15723Oct 21, 2026GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before
- CVE-2026-16255Oct 21, 2026GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before
Follow CVE-2023-3932 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future GitLab CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.