Loading story…
GitLab released security updates for Community Edition and Enterprise Edition to fix multiple vulnerabilities in versions 16.2.2, 16.1.3, and 16.0.8, and urged self-managed customers to upgrade immediately. The fixes addressed two high-severity Regular Expression Denial of Service (ReDoS) flaws in Markdown processing, along with several medium- and low-severity issues involving cross-site scripting, denial of service, token exposure, authorization weaknesses, and information disclosure. GitLab.com was already running the patched version when the notice was issued, and the release also updated bundled Mattermost to 7.10.4 and Redis to 6.2.13 to mitigate additional security issues.
One of the patched flaws, tracked as CVE-2023-3932, affected GitLab Enterprise Edition and could allow an attacker to run pipeline jobs as an arbitrary user through scheduled security scan policies because of incorrect user management. The issue affected GitLab EE versions from 13.12 before 16.0.8, from 16.1.0 before 16.1.3, and from 16.2.0 before 16.2.2; it was later assigned a CVSS v3.1 score of 5.3 and credited to a HackerOne report submitted by researcher vaib25vicky.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2023-3932 states that the vulnerability was published on August 3, 2023. The issue affects GitLab EE and could allow pipeline jobs to run as an arbitrary user through scheduled security scan policies.
On August 1, 2023, GitLab released security updates for Community Edition and Enterprise Edition and urged affected self-managed installations to upgrade immediately. The release fixed multiple vulnerabilities, including the pipeline job execution flaw later tracked as CVE-2023-3932, and updated bundled Mattermost and Redis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition to fix multiple vulnerabilities, including the critical `CVE-2024-6678`. GitLab said the flaw can let an attacker trigger a pipeline as an arbitrary user under certain circumstances and assigned it a `CVSS 9.9`, urging customers to upgrade immediately. GitLab.com had already been patched, and GitLab Dedicated customers did not need to take action. The patch bundle also addressed three high-severity issues and numerous medium- and low-severity flaws affecting pipelines, Product Analytics, Dependency Proxy, OAuth flows, CI/CD variables, repository mirroring, and access controls. A separate CVE entry for `CVE-2024-8640` was listed without public details, while GitLab also noted one issue involving arbitrary unclaimed provider identities had not yet received a CVE at the time of publication.
Jul 24, 2026
GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.
Jul 24, 2026
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition instances, fixing 18 vulnerabilities including a critical issue tracked as `CVE-2024-6678` with a CVSS score of 9.9. The flaw could let an attacker trigger a CI/CD pipeline as an arbitrary user and perform a stop action under certain conditions. GitLab said GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. The release also fixes several high-severity bugs, including command injection into a connected Cube server via YAML configuration (`CVE-2024-8640`), server-side request forgery through Maven Dependency Proxy requests to internal resources (`CVE-2024-8635`), and a denial-of-service condition caused by a crafted POST request or large `glm_source` parameter (`CVE-2024-8124`). Additional medium-severity patches address token and session abuse, permission bypasses, information disclosure, and open redirects that could contribute to account takeover through broken OAuth flows, and GitLab urged all self-managed administrators to upgrade immediately.
Jul 24, 2026