CVE-2024-12619

Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.

Affected

GitLab

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 GITLAB

5.2 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 18th percentile

Published

2025-03-28

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2888260

Security advisories

• https://gitlab.com/gitlab-org/gitlab/-/issues/509324

References

• CVE Record
• NVD entry