CVE-2023-5356: Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions…

PriorityP354high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.83%

52.9th percentile

Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 16.6.5-3 (sid)	gitlab 16.6.5-3 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	>= 16.6 < 16.6.4	16.6.4
gitlab	gitlab	>= 16.6.0 < 16.6.4	16.6.4
gitlab	gitlab	>= 16.7 < 16.7.2	16.7.2
gitlab	gitlab	>= 8.13 < 16.5.6	16.5.6
gitlab	gitlab	>= 8.13.0 < 16.5.6	16.5.6
gitlab	gitlab_ce	—	—

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv8.8HIGH

vendor_debian7.3HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.