CVE-2023-3907

A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS

0.68% chance of exploitation in the next 30 days, 50th percentile

Published

2023-12-17

Updated

2026-05-31

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2058934

References

• CVE Record
• NVD entry

Related

• CVE-2023-39063
• CVE-2023-39070
• CVE-2023-39062
• CVE-2023-39075
• CVE-2023-3906
• CVE-2023-3909