CVE-2023-5612 MEDIUM

CVE-2023-5612: Missing Authorization in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-862 · Missing authorization
Published January 26, 2024
Last update November 20, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

Key dates

02Disclosure timeline

January 26, 2024 CVE published
November 20, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-43219 WordPress Persian WooCommerce plugin <= 7.1.6 - Broken Access Control vulnerability CVE-2026-4277 Privilege abuse in GenericInlineModelAdmin CVE-2023-28417 WordPress Dynamics 365 Integration plugin <= 1.3.12 - Broken Access Control vulnerability CVE-2022-2373 Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure CVE-2023-47698 WordPress Japanized For WooCommerce plugin <= 2.6.4 - Multiple Broken Access Control vulnerability