CVE-2023-2190 MEDIUM

CVE-2023-2190: Authorization Bypass Through User-Controlled Key in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-639 · IDOR
Published July 13, 2023
Last update October 30, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.

Key dates

02Disclosure timeline

July 13, 2023 CVE published
October 30, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-11895 Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2022-2730 Authorization Bypass Through User-Controlled Key in openemr/openemr CVE-2026-6008 IDOR in Im Park's DijiDemi CVE-2025-7049 WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover CVE-2026-8611 Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter