Loading vulnerability…
Incorrect User Management in GitLab EE scheduled security scan policies
CVE-2023-3932 is an incorrect user management vulnerability in GitLab Enterprise Edition that affects all versions from 13.12 before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2. The flaw allows an attacker to cause pipeline jobs to run as an arbitrary user through scheduled security scan policies. The issue stems from improper handling of user context or authorization in the scheduled security scan policy workflow, enabling pipeline execution under another user’s identity rather than the attacker’s own effective permissions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to execute pipeline jobs as an arbitrary user. Because pipelines can access project resources, CI/CD variables, repository contents, and actions available to the impersonated user within the pipeline context, this can result in unauthorized access to sensitive data and unauthorized execution of CI/CD operations with another user’s privileges. The CVE record indicates high confidentiality and integrity impact, with no direct availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting or disabling use of scheduled security scan policies until the instance can be upgraded. Limit who can create, modify, or schedule security policies and closely review projects and groups where security policy-driven pipelines are enabled. Additional hardening should include minimizing privileged CI/CD contexts and reviewing pipeline permissions for sensitive projects.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. The vulnerability is addressed in GitLab EE 16.0.8, 16.1.3, and 16.2.2. Installations running affected versions should be updated to the appropriate patched version or a later supported release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.