CVE-2024-11669

Description

An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.

Reserved 2024-11-25 | Published 2024-11-26 | Updated 2024-11-30 | Assigner GitLab

Product status

Default status
unaffected

16.9.8 before 17.4.5
affected

17.5 before 17.5.3
affected

17.6 before 17.6.1
affected

Credits

This vulnerability has been discovered internally by GitLab team member Dylan Griffith. finder

References

gitlab.com/gitlab-org/gitlab/-/issues/501528 (GitLab Issue #501528) issue-tracking permissions-required

cve.org (CVE-2024-11669)

nvd.nist.gov (CVE-2024-11669)

Download JSON