{"id":"CVE-2016-4340","aliases":["EUVD-2016-5340","GHSA-rxh8-jh3g-ccqq","UBUNTU-CVE-2016-4340"],"status":"published","title":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through...","description":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to \"log in\" as any other user via unspecified vectors.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.10143,"percentile":0.95684,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264"],"published":"2017-01-23T21:00:00Z","modified":"2026-10-30T10:30:26Z","exploits":[{"source":"exploitdb","id":"EDB-40236","title":"GitLab - 'impersonate' Feature Privilege Escalation","type":"webapps","platform":"ruby","date":"2016-08-15","url":"https://www.exploit-db.com/exploits/40236"}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gitlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.3+dfsg-9","8.4.3+dfsg-12","8.5.8+dfsg-5"]}],"products":[{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Patch","Vendor Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/40236/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://gitlab.com/gitlab-org/gitlab-ce/issues/15548","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"http://packetstormsecurity.com/files/138368/GitLab-Impersonate-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4340"},{"url":"https://about.gitlab.com/2016/05/02/cve-2016-4340-patches"},{"url":"https://www.exploit-db.com/exploits/40236"},{"url":"https://github.com/advisories/GHSA-rxh8-jh3g-ccqq"},{"url":"https://ubuntu.com/security/CVE-2016-4340","tags":["report"]},{"url":"https://about.gitlab.com/2016/04/28/gitlab-major-security-update-for-cve-2016-4340/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4340","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4340","description":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to \"log in\" as any other user via unspecified vectors.","status":"published","published":"2017-01-23T21:00:00Z","modified":"2024-08-06T00:25:14.505Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5340","description":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to \"log in\" as any other user via unspecified vectors.","status":"published","published":"2017-01-23T21:00:00Z","modified":"2024-08-06T00:25:14Z","updated_at":"2026-11-03T02:22:46.750795Z"}],"ghsa":[{"id":"GHSA-rxh8-jh3g-ccqq","title":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through...","description":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to \"log in\" as any other user via unspecified vectors.","status":"published","published":"2022-05-17T03:03:04Z","modified":"2025-04-20T03:32:32Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:39.626411Z"}],"nvd":[{"id":"CVE-2016-4340","description":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to \"log in\" as any other user via unspecified vectors.","status":"published","published":"2017-01-23T21:59:01.487Z","modified":"2026-06-17T00:47:22.557Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-4340","description":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to \"log in\" as any other user via unspecified vectors.","status":"published","published":"2017-01-23T21:59:01.487Z","modified":"2026-10-30T10:30:26.233106008Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"UBUNTU-CVE-2016-4340","description":"The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to \"log in\" as any other user via unspecified vectors.","status":"published","published":"2017-01-23T21:59:00Z","modified":"2025-10-24T04:45:45Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"}]}}