CVE-2024-0456

MEDIUM

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that...

Affects 1 product across 1 vendor.

CVSS 3.14.3
EPSS0.5%
Percentile41th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no availability impact.
CWE Weakness Definitions
CWE-425: CWE-425
Related Attack Patterns (CAPEC)
CAPEC-127 Directory Indexing
via CWE-425
CAPEC-143 Detect Unpublicized Web Pages
via CWE-425
CAPEC-144 Detect Unpublicized Web Services
via CWE-425
CAPEC-87 Forceful Browsing
via CWE-425
CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB)
via CWE-425

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A medium severity vulnerability affects Gitlab systems (CVE-2024-0456). No public exploit code is currently available. Review vendor advisories and apply patches during the next maintenance window.

BSID: BS-2024-GLOBAL-052600-M • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-0456?
A medium severity vulnerability affects Gitlab systems (CVE-2024-0456). No public exploit code is currently available. Review vendor advisories and apply patches during the next maintenance window.
What is the CVSS score for CVE-2024-0456?
CVE-2024-0456 has CVSS 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS: 0.5%.
Is CVE-2024-0456 actively exploited?
No confirmed active exploitation of CVE-2024-0456 as of 2026-05-30.
How do I remediate CVE-2024-0456?
Priority: LOW. Advisory: https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ PSIRT: [email protected]
What systems are affected by CVE-2024-0456?
CVE-2024-0456 affects Gitlab Gitlab.
Vulnerability Details
CVE IDCVE-2024-0456
BSIDBS-2024-GLOBAL-052600-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published2024-01-26
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-425
Domains
CLOUD
SourceNVD
Official Description

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Gitlab Gitlab 16.8.0 ≥ 14.0.0, < 16.6.6 ≥ 16.7.0, < 16.7.4
Remediation
View Vendor Advisory →

Remediation Priority: LOW

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 994 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash65e1ae67c835902dbc1fd33563d3d71e9bab6fa070ec116c73f76128b8cffa0621425e1742d014e983a914d23cfe720df9dde36de65626c3394e9a6522435131
Related CVEs affecting Gitlab
CVE-2021-22205 10.0 An issue has been discovered in GitLab CE/EE affecting all versions starting ... CVE-2019-9174 10.0 An issue was discovered in GitLab Community and Enterprise Edition before 11.... CVE-2020-13300 10.0 GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authoriz... CVE-2018-18843 10.0 The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 1... CVE-2026-85706 10.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18...
View all Gitlab CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →