CVE-2024-12244

Missing Authorization in GitLab

An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.

Affected

GitLab

CVSS v3.1 GITLAB

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.31% chance of exploitation in the next 30 days, 22nd percentile

Published

2025-04-24

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2862754

Security advisories

• https://gitlab.com/gitlab-org/gitlab/-/issues/508046

References

• CVE Record
• NVD entry