Public vulnerability disclosure

CVE-2023-4379

Incorrect Authorization in GitLab

publishedCWE-863

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

Investigate in Cyber JSON Markdown

Technical severity8.1 highCVSS 3.1 · CNA: GitLab

Published2023-11-09Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Fix

Upgrade to version 16.2.8, 16.3.5, 16.4.1 or above

Source: CNA: GitLab

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
GitLab GitLab	≥ 15.3; < 16.2.8 (affected, semver) ≥ 16.3; < 16.3.5 (affected, semver) ≥ 16.4; < 16.4.1 (affected, semver) Other versions: unaffected	CNA: GitLab

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 8.1 high	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N`	CNA: GitLab

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://gitlab.com/gitlab-org/gitlab/-/issues/415496CNA: GitLab · issue-tracking
https://gitlab.com/gitlab-org/gitlab/-/issues/415496ADP: CVE · issue-tracking, x_transferred