CVE-2024-4006: Personal Access Token scopes not honoured by GraphQL subscriptions
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.9.6Fixed in 16.10.4Fixed in 16.11.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.9.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.10.4 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-4006
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-4006?
CVE-2024-4006 is classified as a significant vulnerability that affects personal access scopes in GitLab.
How do I fix CVE-2024-4006?
To fix CVE-2024-4006, update your GitLab installation to version 16.9.6 or later if on versions 16.7 to 16.9, or upgrade to version 16.10.4 or higher if using versions from 16.10.
Which versions of GitLab are affected by CVE-2024-4006?
CVE-2024-4006 affects all GitLab CE/EE versions from 16.7 before 16.9.6, from 16.10 before 16.10.4, and version 16.11.0.
What kind of issue does CVE-2024-4006 represent?
CVE-2024-4006 represents a vulnerability where personal access scopes were not honored by GraphQL subscriptions.
Is CVE-2024-4006 applicable to both Community and Enterprise editions of GitLab?
Yes, CVE-2024-4006 is applicable to both GitLab Community Edition and GitLab Enterprise Edition.