Summary
generated automatically from NVD dataGitLab CE/EE contains an incorrect authorization check (CWE-863) in its Slack and Mattermost integrations. A user can abuse these integrations to run slash commands as another user. The affected ranges run from 8.13 before 16.5.6, from 16.6 before 16.6.4, and from 16.7 before 16.7.2. The flaw is rated HIGH with a CVSS v3.1 score of 7.3.
NVD description
Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.
EPSS · FIRST.org
0.83%probability of exploitation in the next 30 days
Higher than 56% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 12 janv. 2024
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- cve@gitlab.com
Affected products
Weaknesses (CWE)
References (4)
- https://hackerone.com/reports/2188868Permissions Required
- https://hackerone.com/reports/2188868Permissions Required
Similar CVEs
Other vulnerabilities of type CWE-863
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.