# CVE-2023-4379: Incorrect Authorization in GitLab

Status: published. Published: 2023-11-09. Updated: 2026-11-02.

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

## Remediation

- fix: Upgrade to version 16.2.8, 16.3.5, 16.4.1 or above (source: CNA: GitLab)

## Affected products and versions

- GitLab / GitLab: ≥ 15.3; < 16.2.8 (affected, semver); ≥ 16.3; < 16.3.5 (affected, semver); ≥ 16.4; < 16.4.1 (affected, semver). Source: CNA: GitLab

## Severity and prioritization

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N; source: CNA: GitLab

- CISA KEV: No listing in collected sources

- EPSS: 0.60% as of 2026-11-01; percentile 48.73%

- SSVC: exploitation poc; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://gitlab.com/gitlab-org/gitlab/-/issues/415496 (CNA: GitLab; issue-tracking)

- https://gitlab.com/gitlab-org/gitlab/-/issues/415496 (ADP: CVE; issue-tracking, x_transferred)

## Provenance

- CNA: GitLab: https://www.cve.org/CVERecord?id=CVE-2023-4379; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2023-4379; retrieved 2026-11-02; source updated Not reported

Revision: 7c965890d13eaf5ac96cc84be07a907ef84d92fd139402be3cda7d1f0e37956a

Canonical: https://y2.dev/cve/CVE-2023-4379