CVE-2023-3115

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2023-09-29

Updated

2025-11-20

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2004158

References

• CVE Record
• NVD entry

Related

• CVE-2023-31132
• CVE-2023-3118
• CVE-2023-31128
• CVE-2023-3119
• CVE-2023-31126
• CVE-2023-31192