Every CVE Search/ Get API key

CVE-2023-2485

Incorrect Privilege Assignment in GitLab

4.4 MediumFix available

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.82%Up 0.8 points since Jun 8, 2023
90%50%10%1%

What each source reports

CVE List Score used 4.4

Incorrect Privilege Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Record
CVE-2023-2485
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-266
Updated
2026-11-02
EUVDEUVD-2023-33969 4.4

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Record
EUVD-2023-33969
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-g9jp-p8w6-7f2q 4.4

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15...

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Record
GHSA-g9jp-p8w6-7f2q
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-266, CWE-269
Updated
2026-11-02
NVD 4.4

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Record
CVE-2023-2485
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-266
Updated
2026-11-02
OSV 4.4

Incorrect Privilege Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Record
CVE-2023-2485
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-266
Updated
2026-11-02
OSVUBUNTU-CVE-2023-2485 4.9

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Record
UBUNTU-CVE-2023-2485
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBIT-gitlab-2023-2485 No score

Incorrect Privilege Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Record
BIT-gitlab-2023-2485
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gitlab
Bitnami
 14.1.0 up to 15.10.8, 15.11.0 up to 15.11.7, 16.0.0 up to 16.0.2
15.10.815.11.716.0.2
gitlab
Ubuntu:16.04:LTS
 All versions, plus listed versions
8.4.3+dfsg-98.4.3+dfsg-128.5.8+dfsg-5
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2485 is a medium vulnerability (CVSS 4.4) in Gitlab, published June 7, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in gitlab 15.10.8.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open