CVE-2024-1250 — Privilege Chaining in GitLab

CVE-2024-1250

Privilege Chaining in GitLab PUBLISHED

Description (CNA)

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 16.8 before 16.8.2

CWE

CWE-268

References

https://gitlab.com/gitlab-org/gitlab/-/issues/439175

ADP enrichment

CVE

No English description supplied.

https://gitlab.com/gitlab-org/gitlab/-/issues/439175

CISA-ADP

No English description supplied.

No references supplied.