MEDIUM
CVE-2023-0485
CVSS
6.5
Description
An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork.
Summary dbcve.org
A broken access control vulnerability in GitLab allowed demoted project members (reduced to user role) to continue reading project updates by viewing diffs against a pre-existing fork. The fork relationship persisted after permission revocation, enabling unauthorized access to project content.
Mitigation
Upgrade GitLab to version 15.8.5, 15.9.4, 15.10.1 or later. Review audit logs for unauthorized fork diff access from demoted users.
Weakness (CWE)
CWE-668
EPSS Score
0.96%
Probability of exploitation in next 30 days
59.9th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.