Loading vulnerability…
Incorrect Authorization in GitLab EE Allowed to Merge Permission
CVE-2023-4658 is an incorrect authorization vulnerability in GitLab Enterprise Edition in which a guest user could abuse the protected-branch "Allowed to merge" permission when that permission was granted through a group. The flaw affects GitLab EE versions starting from 8.13 before 16.4.3, starting from 16.5 before 16.5.3, and starting from 16.6 before 16.6.1. The issue stems from improper enforcement of authorization logic for merge permissions inherited via group membership, allowing a user with guest-level access to obtain merge capability that should not have been available at that privilege level.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the integrity of protected branches by allowing an unauthorized low-privilege user to merge changes despite only holding guest access. This can enable unauthorized modification of repository history or branch contents through merges into protected branches, undermining branch protection controls and project governance. Available information indicates integrity impact without corresponding confidentiality or availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, review and restrict use of group-granted protected-branch merge permissions, especially configurations where guest users may inherit "Allowed to merge" through group membership. Audit protected branch settings and effective permissions for low-privilege users, and remove or narrow group-based merge entitlements until the instance can be upgraded.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 16.4.3, 16.5.3, and 16.6.1 or later, depending on the deployed release train. Organizations running affected self-managed instances should update to the latest supported patched version as soon as possible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.