CVE-2023-6477: User with “admin_group_members” permission can invite other groups to gain owner access
An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admingroupmember permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6477?
CVE-2023-6477 is classified as a medium severity vulnerability.
How do I fix CVE-2023-6477?
To fix CVE-2023-6477, upgrade GitLab to version 16.7.6, 16.8.3, or 16.9.1 or later.
Which versions of GitLab are affected by CVE-2023-6477?
CVE-2023-6477 affects GitLab versions starting from 16.5 before 16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1.
What are the potential risks of CVE-2023-6477?
CVE-2023-6477 may allow users assigned a custom role with admin_group_member permission to gain unauthorized access.
Is there any workaround for CVE-2023-6477 before applying a patch?
Currently, there are no known workarounds for CVE-2023-6477; upgrading to a fixed version is the recommended action.