Skip to main content

Execution with Unnecessary Privileges

CVE-2024-8266

Medium
4.4/10

Summary

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances.

  • HIGH
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • HIGH
  • NONE
  • NONE

CWE-250 - Execution with Unnecessary Privileges

The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References

Advisory Timeline

  • Published