← Back

CVE-2024-7296

nvd nist
Published: Mar 13, 2025Modified: Jun 17, 2026

JSON object

Loading...
2.7
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Exploitability: 1.2 / Impact: 1.4
Source: cve@gitlab.com (Secondary)

Description

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
16.5.0 ≤ version < 17.7.7
Gitlab
17.8.0 ≤ version < 17.8.5
Gitlab
17.9.0 ≤ version < 17.9.2
Gitlab
16.5.0 ≤ version < 17.7.7
Gitlab
17.8.0 ≤ version < 17.8.5
Gitlab
17.9.0 ≤ version < 17.9.2

Related CWEs

CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

Source: cve@gitlab.com
ExploitIssue Tracking
Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.