CVE-2024-11669

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-11669
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-11669.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-11669
Aliases
Downstream
Related
Published
2024-11-26T18:41:09.488Z
Modified
2025-11-30T11:47:13.348714Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11669.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
ba61754a51985835b6adcdc9405767d030270b96
Fixed
3ead12a16d7bd8f1c481504e03042aaf6e10f108
Database specific 
{
    "versions": [
        {
            "introduced": "16.9.8"
        },
        {
            "fixed": "17.4.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
173959793c1163052d16c2158773ea9504aa712e
Fixed
9d81c27eee72f4a5fca5ced8394b72df155e1646
Database specific 
{
    "versions": [
        {
            "introduced": "17.5"
        },
        {
            "fixed": "17.5.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
a8830741d3c4ad7f6a70eed38ee7af31f298d093
Fixed
5f698b15f67b3a7a905ec04dd65ea086376e749a
Database specific 
{
    "versions": [
        {
            "introduced": "17.6"
        },
        {
            "fixed": "17.6.1"
        }
    ]
}

Affected versions

v17.*

v17.5.0-ee
v17.5.1-ee
v17.5.2-ee
v17.6.0-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-11669.json"