CVE-2023-3964

Incorrect Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.

Affected

GitLab

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2023-12-01

Updated

2026-05-06

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2037316

Security advisories

• https://gitlab.com/gitlab-org/gitlab/-/issues/419857

References

• CVE Record
• NVD entry