CVE-2024-0861

Direct Request ('Forced Browsing') in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.

Affected

GitLab

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33rd percentile

Published

2024-02-21

Updated

2026-05-01

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2316435

References

• CVE Record
• NVD entry