CVE-2023-3914

A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2023-09-29

Updated

2026-08-14

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2040822

References

• CVE Record
• NVD entry

Related

• CVE-2023-39139
• CVE-2023-39141
• CVE-2023-39138
• CVE-2023-39143
• CVE-2023-39137
• CVE-2023-39144