Loading vulnerability…
GitLab EE CODEOWNERS Approval Bypass
CVE-2023-4812 is an authorization-enforcement flaw in GitLab Enterprise Edition CODEOWNERS approval handling. In affected versions, changes can be added to a merge request after it has received the required CODEOWNERS approval without requiring that approval to be re-evaluated, bypassing the configured approval requirement.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to modify an already approved merge request can bypass the required CODEOWNERS approval control for subsequently added changes. This can undermine protected code-review and approval policies by allowing changes to avoid the designated code-owner review requirement.
If you can’t patch tonight, do this now.
No specific workaround is documented beyond applying the vendor update. Until patched, restrict who can modify merge requests after approval and apply heightened review to merge requests whose contents change after CODEOWNERS approval has been granted.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release: 16.5.6 or later for the 15.3–16.5 release line, 16.6.4 or later for the 16.6 release line, or 16.7.2 or later for the 16.7 release line. Later maintenance releases are preferable where available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.