A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Gitlab
  • Gitlab

Configuration 1 [-]

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.1:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.7.1:*:*:*:enterprise:*:*:*

No data.

References
Link Providers
https://gitlab.com/gitlab-org/gitlab/-/issues/432188 cve-icon cve-icon
History

Tue, 17 Jun 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Oct 2024 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-668

Thu, 03 Oct 2024 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Thu, 03 Oct 2024 06:30:00 +0000

Type Values Removed Values Added
Description An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.
Title Improper Access Control in GitLab Missing Authorization in GitLab
Weaknesses CWE-862

Fri, 30 Aug 2024 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 30 Aug 2024 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Thu, 29 Aug 2024 15:15:00 +0000

Type Values Removed Values Added
Description An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2024-01-12T13:56:31.881Z

Updated: 2025-06-17T21:09:18.490Z

Reserved: 2023-12-19T17:02:08.767Z

Link: CVE-2023-6955

cve-icon Vulnrichment

Updated: 2024-08-02T08:42:08.572Z

cve-icon NVD

Status : Analyzed

Published: 2024-01-12T14:15:49.233

Modified: 2025-05-05T14:11:28.143

Link: CVE-2023-6955

cve-icon Redhat

No data.