CVE-2023-6955

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-6955
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-6955.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-6955
Aliases
Downstream
Published
2024-01-12T13:56:31.881Z
Modified
2025-11-27T02:34:01.972506Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Missing Authorization in GitLab
Details

A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/cc431b3424123d84bcd7afd4de150b33f117a8ef/cves/2023/6xxx/CVE-2023-6955.json",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
328c57b01842700127bb3d1302f5b5b967fa4442
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.5.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
94991886af3e3820aa09fa353b29cf8557c93168
Fixed
1873157df5a1e602741dc5fbe790db81888baea4
Database specific 
{
    "versions": [
        {
            "introduced": "16.6"
        },
        {
            "fixed": "16.6.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
9e7d34f7ff11405ece06ec398b66965d153cee6f
Fixed
847f5d82ad6aa1208a61fee603fc0e0ce1786f19
Database specific 
{
    "versions": [
        {
            "introduced": "16.7"
        },
        {
            "fixed": "16.7.2"
        }
    ]
}